npm - @authup/server-core - Versions diffs - 1.0.0-beta.37 → 1.0.0-beta.38 - Mend

@authup/server-core 1.0.0-beta.37 → 1.0.0-beta.38

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (181) hide show

package/dist/app/modules/oauth2/module.mjs CHANGED Viewed

@@ -83,10 +83,13 @@ var OAuth2Module = class {
 			return new OAuth2TokenVerifier(c.resolve(OAuth2InjectionToken.KeyRepository), c.resolve(OAuth2InjectionToken.TokenRepository));
 		} });
 		container.register(OAuth2InjectionToken.AccessTokenIssuer, { useFactory: (c) => {
-			return new OAuth2AccessTokenIssuer(c.resolve(OAuth2InjectionToken.TokenRepository), c.resolve(OAuth2InjectionToken.TokenSigner), {
+			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
+			const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);
+			const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);
+			return new OAuth2AccessTokenIssuer(tokenRepository, tokenSigner, {
 				maxAge: config.tokenAccessMaxAge,
 				issuer: config.publicUrl
-			});
+			}, identityRoleProvider);
 		} });
 		container.register(OAuth2InjectionToken.RefreshTokenIssuer, { useFactory: (c) => {
 			return new OAuth2RefreshTokenIssuer(c.resolve(OAuth2InjectionToken.TokenRepository), c.resolve(OAuth2InjectionToken.TokenSigner), {

package/dist/app/modules/oauth2/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["CacheInjectionKey","ModuleName","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2KeyRepository","OAuth2ScopeRepository","OAuth2TokenRepository","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","KeyRepository","TokenSigner","keyRepository","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","issuer","publicUrl","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\n\nimport {\n OAuth2AuthorizationCodeRepository,\n OAuth2AuthorizationStateRepository,\n OAuth2ClientRepository,\n OAuth2KeyRepository,\n OAuth2ScopeRepository, \n OAuth2TokenRepository,\n} from './repositories/index.ts';\nimport {\n OAuth2AccessTokenIssuer,\n OAuth2AuthorizationCodeIssuer,\n OAuth2AuthorizationCodeRequestVerifier,\n OAuth2AuthorizationCodeVerifier,\n OAuth2AuthorizationStateManager,\n OAuth2OpenIDTokenIssuer,\n OAuth2RefreshTokenIssuer,\n OAuth2TokenRevoker,\n OAuth2TokenSigner,\n OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\n\nexport class OAuth2Module implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n constructor() {\n this.name = ModuleName.OAUTH2;\n this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n }\n\n async setup(container: IContainer) : Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n\n container.register(OAuth2InjectionToken.ClientRepository, {\n useFactory: (c) => {\n const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n return new OAuth2ClientRepository(repository);\n },\n });\n\n container.register(OAuth2InjectionToken.ScopeRepository, {\n useFactory: (c) => {\n const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n return new OAuth2ScopeRepository(repository);\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2AuthorizationCodeRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2AuthorizationStateRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.TokenRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2TokenRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.KeyRepository, {\n // todo: cache use here\n useFactory: () => new OAuth2KeyRepository(),\n });\n\n container.register(OAuth2InjectionToken.TokenSigner, {\n useFactory: (c) => {\n const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n return new OAuth2TokenSigner(keyRepository);\n },\n });\n\n // authorization code issuer\n container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n useFactory: (c) => {\n const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n return new OAuth2AuthorizationCodeIssuer(\n codeRepository,\n {\n // todo: own constant here\n maxAge: config.tokenAccessMaxAge,\n },\n );\n },\n });\n container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n useFactory: (c) => {\n const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n return new OAuth2AuthorizationCodeVerifier(codeRepository);\n },\n });\n\n // authorization code request verifier\n container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n useFactory: (c) => {\n const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n return new OAuth2AuthorizationCodeRequestVerifier({\n clientRepository,\n scopeRepository: clientScopeRepository,\n });\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n useFactory: (c) => {\n const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n return new OAuth2AuthorizationStateManager(stateRepository);\n },\n });\n\n // token revoker\n container.register(OAuth2InjectionToken.TokenRevoker, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n return new OAuth2TokenRevoker(tokenRepository);\n },\n });\n\n // token verifier\n container.register(OAuth2InjectionToken.TokenVerifier, {\n useFactory: (c) => {\n const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n return new OAuth2TokenVerifier(keyRepository, tokenRepository);\n },\n });\n\n // access token issuer\n container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n return new OAuth2AccessTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.tokenAccessMaxAge,\n issuer: config.publicUrl,\n },\n );\n },\n });\n\n // refresh token issuer\n container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n return new OAuth2RefreshTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.tokenRefreshMaxAge,\n issuer: config.publicUrl,\n },\n );\n },\n });\n\n // open-id token issuer\n container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n useFactory: (c) => {\n const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n return new OAuth2OpenIDTokenIssuer({\n repository,\n signer,\n\n identityResolver,\n\n options: {\n // todo: own constant here\n maxAge: config.tokenAccessMaxAge,\n issuer: config.publicUrl,\n },\n });\n },\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,IAAauB,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;AACV,OAAKD,OAAOvB,WAAWyB;AACvB,OAAKD,eAAe;GAACxB,WAAW0B;GAAU1B,WAAW2B;GAAO3B,WAAW4B;GAAQ5B,WAAW6B;GAAS;;CAGvG,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQZ,mBAAAA;AAEjCU,YAAUG,SAASjB,qBAAqBkB,kBAAkB,EACtDC,aAAaC,MAAAA;AAET,UAAO,IAAIlC,uBADQkC,EAAEJ,QAAkCd,aACrBmB,CAAAA;KAE1C,CAAA;AAEAP,YAAUG,SAASjB,qBAAqBsB,iBAAiB,EACrDH,aAAaC,MAAAA;AAET,UAAO,IAAIhC,sBADQgC,EAAEJ,QAAuCb,kBAC3BkB,CAAAA;KAEzC,CAAA;AAEAP,YAAUG,SAASjB,qBAAqBuB,6BAA6B,EACjEJ,aAAaC,MAAAA;AAET,UAAO,IAAIpC,kCADGoC,EAAEJ,QAAQlC,kBACqB0C,CAAAA;KAErD,CAAA;AAEAV,YAAUG,SAASjB,qBAAqByB,8BAA8B,EAClEN,aAAaC,MAAAA;AAET,UAAO,IAAInC,mCADGmC,EAAEJ,QAAQlC,kBACsB0C,CAAAA;KAEtD,CAAA;AAEAV,YAAUG,SAASjB,qBAAqB0B,iBAAiB,EACrDP,aAAaC,MAAAA;AAET,UAAO,IAAI/B,sBADG+B,EAAEJ,QAAQlC,kBACS0C,CAAAA;KAEzC,CAAA;AAEAV,YAAUG,SAASjB,qBAAqB2B,eAAe,EAEnDR,kBAAkB,IAAIhC,qBAAAA,EAC1B,CAAA;AAEA2B,YAAUG,SAASjB,qBAAqB4B,aAAa,EACjDT,aAAaC,MAAAA;AAET,UAAO,IAAItB,kBADWsB,EAAEJ,QAAQhB,qBAAqB2B,cACxBE,CAAAA;KAErC,CAAA;AAGAf,YAAUG,SAASjB,qBAAqB8B,yBAAyB,EAC7DX,aAAaC,MAAAA;AAGT,UAAO,IAAI7B,8BAFY6B,EAAEJ,QAAQhB,qBAAqBuB,4BAGlDQ,EACA,EAEIC,QAAQjB,OAAOkB,mBACnB,CAAA;KAGZ,CAAA;AACAnB,YAAUG,SAASjB,qBAAqBkC,2BAA2B,EAC/Df,aAAaC,MAAAA;AAGT,UAAO,IAAI3B,gCAFY2B,EAAEJ,QAAQhB,qBAAqBuB,4BAEXQ,CAAAA;KAEnD,CAAA;AAGAjB,YAAUG,SAASjB,qBAAqBmC,kCAAkC,EACtEhB,aAAaC,MAAAA;AAIT,UAAO,IAAI5B,uCAAuC;IAC9C4C,kBAJqBhB,EAAEJ,QAAQhB,qBAAqBkB,iBAIpDkB;IACAE,iBAJ0BlB,EAAEJ,QAAQhB,qBAAqBsB,gBAIxCe;IACrB,CAAA;KAER,CAAA;AAEAvB,YAAUG,SAASjB,qBAAqBuC,2BAA2B,EAC/DpB,aAAaC,MAAAA;AAGT,UAAO,IAAI1B,gCAFa0B,EAAEJ,QAAQhB,qBAAqByB,6BAEZe,CAAAA;KAEnD,CAAA;AAGA1B,YAAUG,SAASjB,qBAAqByC,cAAc,EAClDtB,aAAaC,MAAAA;AAET,UAAO,IAAIvB,mBADauB,EAAEJ,QAAQhB,qBAAqB0B,gBACzBgB,CAAAA;KAEtC,CAAA;AAGA5B,YAAUG,SAASjB,qBAAqB2C,eAAe,EACnDxB,aAAaC,MAAAA;AAIT,UAAO,IAAIrB,oBAHWqB,EAAEJ,QAAQhB,qBAAqB2B,cAGtBE,EAFPT,EAAEJ,QAAQhB,qBAAqB0B,gBAETgB,CAAAA;KAEtD,CAAA;AAGA5B,YAAUG,SAASjB,qBAAqB4C,mBAAmB,EACvDzB,aAAaC,MAAAA;AAGT,UAAO,IAAI9B,wBAFa8B,EAAEJ,QAAQhB,qBAAqB0B,gBAGnDgB,EAFgBtB,EAAEJ,QAAQhB,qBAAqB4B,YAG/CiB,EACA;IACIb,QAAQjB,OAAOkB;IACfa,QAAQ/B,OAAOgC;IACnB,CAAA;KAGZ,CAAA;AAGAjC,YAAUG,SAASjB,qBAAqBgD,oBAAoB,EACxD7B,aAAaC,MAAAA;AAIT,UAAO,IAAIxB,yBAHawB,EAAEJ,QAAQhB,qBAAqB0B,gBAInDgB,EAHgBtB,EAAEJ,QAAQhB,qBAAqB4B,YAI/CiB,EACA;IACIb,QAAQjB,OAAOkC;IACfH,QAAQ/B,OAAOgC;IACnB,CAAA;KAGZ,CAAA;AAGAjC,YAAUG,SAASjB,qBAAqBkD,mBAAmB,EACvD/B,aAAaC,MAAAA;AAKT,UAAO,IAAIzB,wBAAwB;IAC/B0B,YALeD,EAAEJ,QAAQhB,qBAAqB0B,gBAK9CL;IACA8B,QALW/B,EAAEJ,QAAQhB,qBAAqB4B,YAK1CuB;IAEAC,kBANqBhC,EAAEJ,QAAQf,qBAAqBoD,SAMpDD;IAEAE,SAAS;KAELtB,QAAQjB,OAAOkB;KACfa,QAAQ/B,OAAOgC;KACnB;IACJ,CAAA;KAER,CAAA"}
1	+ {"version":3,"file":"module.mjs","names":["CacheInjectionKey","ModuleName","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2KeyRepository","OAuth2ScopeRepository","OAuth2TokenRepository","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","KeyRepository","TokenSigner","keyRepository","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\n\nimport {\n OAuth2AuthorizationCodeRepository,\n OAuth2AuthorizationStateRepository,\n OAuth2ClientRepository,\n OAuth2KeyRepository,\n OAuth2ScopeRepository,\n OAuth2TokenRepository,\n} from './repositories/index.ts';\nimport {\n OAuth2AccessTokenIssuer,\n OAuth2AuthorizationCodeIssuer,\n OAuth2AuthorizationCodeRequestVerifier,\n OAuth2AuthorizationCodeVerifier,\n OAuth2AuthorizationStateManager,\n OAuth2OpenIDTokenIssuer,\n OAuth2RefreshTokenIssuer,\n OAuth2TokenRevoker,\n OAuth2TokenSigner,\n OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\n\nexport class OAuth2Module implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n constructor() {\n this.name = ModuleName.OAUTH2;\n this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n }\n\n async setup(container: IContainer) : Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n\n container.register(OAuth2InjectionToken.ClientRepository, {\n useFactory: (c) => {\n const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n return new OAuth2ClientRepository(repository);\n },\n });\n\n container.register(OAuth2InjectionToken.ScopeRepository, {\n useFactory: (c) => {\n const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n return new OAuth2ScopeRepository(repository);\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2AuthorizationCodeRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2AuthorizationStateRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.TokenRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2TokenRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.KeyRepository, {\n // todo: cache use here\n useFactory: () => new OAuth2KeyRepository(),\n });\n\n container.register(OAuth2InjectionToken.TokenSigner, {\n useFactory: (c) => {\n const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n return new OAuth2TokenSigner(keyRepository);\n },\n });\n\n // authorization code issuer\n container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n useFactory: (c) => {\n const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n return new OAuth2AuthorizationCodeIssuer(\n codeRepository,\n {\n // todo: own constant here\n maxAge: config.tokenAccessMaxAge,\n },\n );\n },\n });\n container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n useFactory: (c) => {\n const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n return new OAuth2AuthorizationCodeVerifier(codeRepository);\n },\n });\n\n // authorization code request verifier\n container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n useFactory: (c) => {\n const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n return new OAuth2AuthorizationCodeRequestVerifier({\n clientRepository,\n scopeRepository: clientScopeRepository,\n });\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n useFactory: (c) => {\n const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n return new OAuth2AuthorizationStateManager(stateRepository);\n },\n });\n\n // token revoker\n container.register(OAuth2InjectionToken.TokenRevoker, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n return new OAuth2TokenRevoker(tokenRepository);\n },\n });\n\n // token verifier\n container.register(OAuth2InjectionToken.TokenVerifier, {\n useFactory: (c) => {\n const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n return new OAuth2TokenVerifier(keyRepository, tokenRepository);\n },\n });\n\n // access token issuer\n container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n return new OAuth2AccessTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.tokenAccessMaxAge,\n issuer: config.publicUrl,\n },\n identityRoleProvider,\n );\n },\n });\n\n // refresh token issuer\n container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n return new OAuth2RefreshTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.tokenRefreshMaxAge,\n issuer: config.publicUrl,\n },\n );\n },\n });\n\n // open-id token issuer\n container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n useFactory: (c) => {\n const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n return new OAuth2OpenIDTokenIssuer({\n repository,\n signer,\n\n identityResolver,\n\n options: {\n // todo: own constant here\n maxAge: config.tokenAccessMaxAge,\n issuer: config.publicUrl,\n },\n });\n },\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,IAAauB,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;AACV,OAAKD,OAAOvB,WAAWyB;AACvB,OAAKD,eAAe;GAACxB,WAAW0B;GAAU1B,WAAW2B;GAAO3B,WAAW4B;GAAQ5B,WAAW6B;GAAS;;CAGvG,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQZ,mBAAAA;AAEjCU,YAAUG,SAASjB,qBAAqBkB,kBAAkB,EACtDC,aAAaC,MAAAA;AAET,UAAO,IAAIlC,uBADQkC,EAAEJ,QAAkCd,aACrBmB,CAAAA;KAE1C,CAAA;AAEAP,YAAUG,SAASjB,qBAAqBsB,iBAAiB,EACrDH,aAAaC,MAAAA;AAET,UAAO,IAAIhC,sBADQgC,EAAEJ,QAAuCb,kBAC3BkB,CAAAA;KAEzC,CAAA;AAEAP,YAAUG,SAASjB,qBAAqBuB,6BAA6B,EACjEJ,aAAaC,MAAAA;AAET,UAAO,IAAIpC,kCADGoC,EAAEJ,QAAQlC,kBACqB0C,CAAAA;KAErD,CAAA;AAEAV,YAAUG,SAASjB,qBAAqByB,8BAA8B,EAClEN,aAAaC,MAAAA;AAET,UAAO,IAAInC,mCADGmC,EAAEJ,QAAQlC,kBACsB0C,CAAAA;KAEtD,CAAA;AAEAV,YAAUG,SAASjB,qBAAqB0B,iBAAiB,EACrDP,aAAaC,MAAAA;AAET,UAAO,IAAI/B,sBADG+B,EAAEJ,QAAQlC,kBACS0C,CAAAA;KAEzC,CAAA;AAEAV,YAAUG,SAASjB,qBAAqB2B,eAAe,EAEnDR,kBAAkB,IAAIhC,qBAAAA,EAC1B,CAAA;AAEA2B,YAAUG,SAASjB,qBAAqB4B,aAAa,EACjDT,aAAaC,MAAAA;AAET,UAAO,IAAItB,kBADWsB,EAAEJ,QAAQhB,qBAAqB2B,cACxBE,CAAAA;KAErC,CAAA;AAGAf,YAAUG,SAASjB,qBAAqB8B,yBAAyB,EAC7DX,aAAaC,MAAAA;AAGT,UAAO,IAAI7B,8BAFY6B,EAAEJ,QAAQhB,qBAAqBuB,4BAGlDQ,EACA,EAEIC,QAAQjB,OAAOkB,mBACnB,CAAA;KAGZ,CAAA;AACAnB,YAAUG,SAASjB,qBAAqBkC,2BAA2B,EAC/Df,aAAaC,MAAAA;AAGT,UAAO,IAAI3B,gCAFY2B,EAAEJ,QAAQhB,qBAAqBuB,4BAEXQ,CAAAA;KAEnD,CAAA;AAGAjB,YAAUG,SAASjB,qBAAqBmC,kCAAkC,EACtEhB,aAAaC,MAAAA;AAIT,UAAO,IAAI5B,uCAAuC;IAC9C4C,kBAJqBhB,EAAEJ,QAAQhB,qBAAqBkB,iBAIpDkB;IACAE,iBAJ0BlB,EAAEJ,QAAQhB,qBAAqBsB,gBAIxCe;IACrB,CAAA;KAER,CAAA;AAEAvB,YAAUG,SAASjB,qBAAqBuC,2BAA2B,EAC/DpB,aAAaC,MAAAA;AAGT,UAAO,IAAI1B,gCAFa0B,EAAEJ,QAAQhB,qBAAqByB,6BAEZe,CAAAA;KAEnD,CAAA;AAGA1B,YAAUG,SAASjB,qBAAqByC,cAAc,EAClDtB,aAAaC,MAAAA;AAET,UAAO,IAAIvB,mBADauB,EAAEJ,QAAQhB,qBAAqB0B,gBACzBgB,CAAAA;KAEtC,CAAA;AAGA5B,YAAUG,SAASjB,qBAAqB2C,eAAe,EACnDxB,aAAaC,MAAAA;AAIT,UAAO,IAAIrB,oBAHWqB,EAAEJ,QAAQhB,qBAAqB2B,cAGtBE,EAFPT,EAAEJ,QAAQhB,qBAAqB0B,gBAETgB,CAAAA;KAEtD,CAAA;AAGA5B,YAAUG,SAASjB,qBAAqB4C,mBAAmB,EACvDzB,aAAaC,MAAAA;GACT,MAAMsB,kBAAkBtB,EAAEJ,QAAQhB,qBAAqB0B,gBAAe;GACtE,MAAMmB,cAAczB,EAAEJ,QAAQhB,qBAAqB4B,YAAW;GAC9D,MAAMkB,uBAAuB1B,EAAEJ,QAAQf,qBAAqB8C,aAAY;AACxE,UAAO,IAAIzD,wBACPoD,iBACAG,aACA;IACIb,QAAQjB,OAAOkB;IACfe,QAAQjC,OAAOkC;IACnB,EACAH,qBAAAA;KAGZ,CAAA;AAGAhC,YAAUG,SAASjB,qBAAqBkD,oBAAoB,EACxD/B,aAAaC,MAAAA;AAIT,UAAO,IAAIxB,yBAHawB,EAAEJ,QAAQhB,qBAAqB0B,gBAInDgB,EAHgBtB,EAAEJ,QAAQhB,qBAAqB4B,YAI/CiB,EACA;IACIb,QAAQjB,OAAOoC;IACfH,QAAQjC,OAAOkC;IACnB,CAAA;KAGZ,CAAA;AAGAnC,YAAUG,SAASjB,qBAAqBoD,mBAAmB,EACvDjC,aAAaC,MAAAA;AAKT,UAAO,IAAIzB,wBAAwB;IAC/B0B,YALeD,EAAEJ,QAAQhB,qBAAqB0B,gBAK9CL;IACAgC,QALWjC,EAAEJ,QAAQhB,qBAAqB4B,YAK1CyB;IAEAC,kBANqBlC,EAAEJ,QAAQf,qBAAqBsD,SAMpDD;IAEAE,SAAS;KAELxB,QAAQjB,OAAOkB;KACfe,QAAQjC,OAAOkC;KACnB;IACJ,CAAA;KAER,CAAA"}

package/dist/app/modules/provisioning/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAsBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAYxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAMH,uBAAuB,EAW1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAOrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;~~cA4IjC~~,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAsBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAYxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAMH,uBAAuB,EAW1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAOrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAgJjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs CHANGED Viewed

@@ -1,19 +1,19 @@
 import { RealmEntity } from "../../../adapters/database/domains/realm/entity.mjs";
 import { ClientEntity } from "../../../adapters/database/domains/client/entity.mjs";
+import { RoleEntity } from "../../../adapters/database/domains/role/entity.mjs";
+import { ClientRoleEntity } from "../../../adapters/database/domains/client-role/entity.mjs";
 import { PermissionEntity } from "../../../adapters/database/domains/permission/entity.mjs";
 import { PolicyRepository } from "../../../adapters/database/domains/policy/repository.mjs";
 import { ClientPermissionEntity } from "../../../adapters/database/domains/client-permission/entity.mjs";
-import { RoleEntity } from "../../../adapters/database/domains/role/entity.mjs";
-import { RolePermissionEntity } from "../../../adapters/database/domains/role-permission/entity.mjs";
-import { ClientRoleEntity } from "../../../adapters/database/domains/client-role/entity.mjs";
 import { ScopeEntity } from "../../../adapters/database/domains/scope/entity.mjs";
-import { UserPermissionEntity } from "../../../adapters/database/domains/user-permission/entity.mjs";
-import { UserRoleEntity } from "../../../adapters/database/domains/user-role/entity.mjs";
 import { UserRepository } from "../../../adapters/database/domains/user/repository.mjs";
 import { RobotEntity } from "../../../adapters/database/domains/robot/entity.mjs";
-import { RobotRoleEntity } from "../../../adapters/database/domains/robot-role/entity.mjs";
-import { RobotPermissionEntity } from "../../../adapters/database/domains/robot-permission/entity.mjs";
 import { PermissionPolicyEntity } from "../../../adapters/database/domains/permission-policy/entity.mjs";
+import { RobotPermissionEntity } from "../../../adapters/database/domains/robot-permission/entity.mjs";
+import { RobotRoleEntity } from "../../../adapters/database/domains/robot-role/entity.mjs";
+import { RolePermissionEntity } from "../../../adapters/database/domains/role-permission/entity.mjs";
+import { UserPermissionEntity } from "../../../adapters/database/domains/user-permission/entity.mjs";
+import { UserRoleEntity } from "../../../adapters/database/domains/user-role/entity.mjs";
 import "../../../adapters/database/domains/index.mjs";
 import { ClientProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/client/module.mjs";
 import { PermissionProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/permission/module.mjs";
@@ -80,9 +80,10 @@ var ProvisionerModule = class {
 			repository: new PolicyRepository(dataSource),
 			realmRepository
 		});
+		const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(container.resolve(PermissionPolicyEntity));
 		const policySynchronizer = new PolicyProvisioningSynchronizer({
 			repository: policyRepository,
-			permissionPolicyRepository: new PermissionPolicyRepositoryAdapter(container.resolve(PermissionPolicyEntity))
+			permissionPolicyRepository
 		});
 		const roleRepository = new RoleRepositoryAdapter({
 			repository: container.resolve(RoleEntity),
@@ -92,7 +93,11 @@ var ProvisionerModule = class {
 			repository: container.resolve(ClientEntity),
 			realmRepository
 		});
-		const permissionSynchronizer = new PermissionProvisioningSynchronizer({ repository: permissionRepository });
+		const permissionSynchronizer = new PermissionProvisioningSynchronizer({
+			repository: permissionRepository,
+			policyRepository,
+			permissionPolicyRepository
+		});
 		const roleSynchronizer = new RoleProvisioningSynchronizer({
 			repository: roleRepository,
 			permissionRepository,

package/dist/app/modules/provisioning/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RobotEntity","RobotPermissionEntity","RobotRoleEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RobotProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RobotPermissionRepositoryAdapter","RobotRepositoryAdapter","RobotRoleRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","robotSynchronizer","robotRepository","robotRoleRepository","robotPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","find","permission","hasAnyPolicy","findOneBy","permission_id","id","save","create","permission_realm_id","realm_id","policy_id","policy_realm_id"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n Client,\n ClientPermission,\n ClientRole,\n PermissionPolicy,\n Realm,\n Robot,\n RobotPermission,\n RobotRole,\n Role,\n RolePermission,\n Scope,\n UserPermission,\n UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n ClientEntity,\n ClientPermissionEntity,\n ClientRoleEntity,\n PermissionEntity,\n RealmEntity,\n RobotEntity,\n RobotPermissionEntity,\n RobotRoleEntity,\n RoleEntity,\n RolePermissionEntity,\n ScopeEntity,\n UserPermissionEntity,\n UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n PermissionPolicyEntity,\n PolicyRepository,\n UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n ClientProvisioningSynchronizer,\n GraphProvisioningSynchronizer,\n PermissionProvisioningSynchronizer,\n PolicyProvisioningSynchronizer,\n RealmProvisioningSynchronizer,\n RobotProvisioningSynchronizer,\n RoleProvisioningSynchronizer,\n ScopeProvisioningSynchronizer,\n UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n ClientPermissionRepositoryAdapter,\n ClientRepositoryAdapter,\n ClientRoleRepositoryAdapter,\n PermissionPolicyRepositoryAdapter,\n PermissionRepositoryAdapter,\n PolicyRepositoryAdapter,\n RealmRepositoryAdapter,\n RobotPermissionRepositoryAdapter,\n RobotRepositoryAdapter,\n RobotRoleRepositoryAdapter,\n RolePermissionRepositoryAdapter,\n RoleRepositoryAdapter,\n ScopeRepositoryAdapter,\n UserPermissionRepositoryAdapter,\n UserRepositoryAdapter,\n UserRoleRepositoryAdapter,\n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n protected sources: IProvisioningSource[];\n\n constructor(sources: IProvisioningSource[] = []) {\n this.name = ModuleName.PROVISIONING;\n this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n this.sources = sources;\n }\n\n async setup(container: IContainer): Promise<void> {\n const sources = [...this.sources];\n\n const config = container.resolve(ConfigInjectionKey);\n const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n if (fs.existsSync(provisioningDir)) {\n sources.push(new FileProvisioningSource({ cwd: provisioningDir }));\n }\n\n const composite = new CompositeProvisioningSource(sources);\n const data = await composite.load(container);\n\n const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n const permissionRepository = new PermissionRepositoryAdapter({\n repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n realmRepository,\n });\n\n const policyRepository = new PolicyRepositoryAdapter({\n repository: new PolicyRepository(dataSource),\n realmRepository,\n });\n\n // ---------------------------------------------------------------\n // Synchronize all entities (policies → permissions → roles → ...)\n // ---------------------------------------------------------------\n\n const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n );\n\n const policySynchronizer = new PolicyProvisioningSynchronizer({\n repository: policyRepository,\n permissionPolicyRepository,\n });\n\n const roleRepository = new RoleRepositoryAdapter({\n repository: container.resolve<Repository<Role>>(RoleEntity),\n realmRepository,\n });\n const clientRepository = new ClientRepositoryAdapter({\n repository: container.resolve<Repository<Client>>(ClientEntity),\n realmRepository,\n });\n\n const permissionSynchronizer = new PermissionProvisioningSynchronizer({ repository: permissionRepository });\n\n const roleSynchronizer = new RoleProvisioningSynchronizer({\n repository: roleRepository,\n permissionRepository,\n policyRepository,\n rolePermissionRepository: new RolePermissionRepositoryAdapter(\n container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n ),\n });\n\n const clientSynchronizer = new ClientProvisioningSynchronizer({\n clientRepository,\n clientRoleRepository: new ClientRoleRepositoryAdapter(\n container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n ),\n clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n\n roleSynchronizer,\n permissionSynchronizer,\n });\n\n const userSynchronizer = new UserProvisioningSynchronizer({\n userRepository: new UserRepositoryAdapter({\n repository: new UserRepository(dataSource),\n realmRepository,\n }),\n userRoleRepository: new UserRoleRepositoryAdapter(\n container.resolve<Repository<UserRole>>(UserRoleEntity),\n ),\n userPermissionRepository: new UserPermissionRepositoryAdapter(\n container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n ),\n\n clientRepository,\n roleRepository,\n permissionRepository,\n });\n\n const robotSynchronizer = new RobotProvisioningSynchronizer({\n robotRepository: new RobotRepositoryAdapter({\n repository: container.resolve<Repository<Robot>>(RobotEntity),\n realmRepository,\n }),\n robotRoleRepository: new RobotRoleRepositoryAdapter(\n container.resolve<Repository<RobotRole>>(RobotRoleEntity),\n ),\n robotPermissionRepository: new RobotPermissionRepositoryAdapter(\n container.resolve<Repository<RobotPermission>>(RobotPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n });\n\n const scopeSynchronizer = new ScopeProvisioningSynchronizer({\n repository: new ScopeRepositoryAdapter({\n repository: container.resolve<Repository<Scope>>(ScopeEntity),\n realmRepository,\n }),\n });\n\n const realmSynchronizer = new RealmProvisioningSynchronizer({\n repository: new RealmRepositoryAdapter(realmRepository),\n\n clientSynchronizer,\n roleSynchronizer,\n permissionSynchronizer,\n userSynchronizer,\n robotSynchronizer,\n scopeSynchronizer,\n });\n\n const rootSynchronizer = new GraphProvisioningSynchronizer({\n policySynchronizer,\n permissionSynchronizer,\n roleSynchronizer,\n realmSynchronizer,\n scopeSynchronizer,\n });\n\n await rootSynchronizer.synchronize(data);\n\n if (config.permissionsDefaultPolicyAssignment) {\n await this.assignDefaultPolicy(dataSource, policyRepository);\n }\n }\n\n protected async assignDefaultPolicy(\n dataSource: DataSource,\n policyRepository: PolicyRepositoryAdapter,\n ): Promise<void> {\n const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n if (!defaultPolicy) {\n return;\n }\n\n const permissionRepo = dataSource.getRepository(PermissionEntity);\n const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n const permissions = await permissionRepo.find();\n for (const permission of permissions) {\n const hasAnyPolicy = await junctionRepo.findOneBy({ permission_id: permission.id });\n\n if (!hasAnyPolicy) {\n await junctionRepo.save(junctionRepo.create({\n permission_id: permission.id,\n permission_realm_id: permission.realm_id,\n policy_id: defaultPolicy.id,\n policy_realm_id: defaultPolicy.realm_id,\n }));\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,IAAaiD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,EAAE,EAAE;AAC7C,OAAKF,OAAOP,WAAWU;AACvB,OAAKF,eAAe,CAACR,WAAWW,QAAQX,WAAWY,SAAS;AAC5D,OAAKH,UAAUA;;CAGnB,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,QAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQb,mBAAAA;EACjC,MAAMc,kBAAkBf,KAAKgB,KAAKH,OAAOI,uBAAuB,eAAA;AAChE,MAAIlB,GAAGmB,WAAWH,gBAAAA,CACdR,SAAQY,KAAK,IAAIhB,uBAAuB,EAAEiB,KAAKL,iBAAgB,CAAA,CAAA;EAInE,MAAMO,OAAO,MAAMD,IADGnB,4BAA4BK,QAC/Bc,CAAUE,KAAKX,UAAAA;EAElC,MAAMY,aAAaZ,UAAUE,QAAQjB,qBAAqB4B,WAAU;EACpE,MAAMC,kBAAkBd,UAAUE,QAA2BvD,YAAAA;EAE7D,MAAMoE,uBAAuB,IAAI1C,4BAA4B;GACzD2C,YAAYhB,UAAUE,QAAsCxD,iBAAAA;GAC5DoE;GACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI3C,wBAAwB;GACjD0C,YAAY,IAAI1D,iBAAiBsD,WAAAA;GACjCE;GACJ,CAAA;EAUA,MAAMK,qBAAqB,IAAIxD,+BAA+B;GAC1DqD,YAAYC;GACZC,4BAAAA,IANmC9C,kCACnC4B,UAAUE,QAAsC7C,uBAAAA,CAKhD6D;GACJ,CAAA;EAEA,MAAME,iBAAiB,IAAIxC,sBAAsB;GAC7CoC,YAAYhB,UAAUE,QAA0BnD,WAAAA;GAChD+D;GACJ,CAAA;EACA,MAAMO,mBAAmB,IAAInD,wBAAwB;GACjD8C,YAAYhB,UAAUE,QAA4B3D,aAAAA;GAClDuE;GACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI5D,mCAAmC,EAAEsD,YAAYD,sBAAqB,CAAA;EAEzG,MAAMQ,mBAAmB,IAAIzD,6BAA6B;GACtDkD,YAAYI;GACZL;GACAE;GACAO,0BAA0B,IAAI7C,gCAC1BqB,UAAUE,QAAoClD,qBAAAA,CAAAA;GAEtD,CAAA;EAEA,MAAMyE,qBAAqB,IAAIjE,+BAA+B;GAC1D6D;GACAK,sBAAsB,IAAIvD,4BACtB6B,UAAUE,QAAgCzD,iBAAAA,CAAAA;GAE9CkF,4BAA4B,IAAI1D,kCAC5B+B,UAAUE,QAAsC1D,uBAAAA,CAAAA;GAGpD4E;GACAL;GAEAQ;GACAD;GACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAI5D,6BAA6B;GACtD6D,gBAAgB,IAAI9C,sBAAsB;IACtCiC,YAAY,IAAIzD,eAAeqD,WAAAA;IAC/BE;IACJ,CAAA;GACAgB,oBAAoB,IAAI9C,0BACpBgB,UAAUE,QAA8B/C,eAAAA,CAAAA;GAE5C4E,0BAA0B,IAAIjD,gCAC1BkB,UAAUE,QAAoChD,qBAAAA,CAAAA;GAGlDmE;GACAD;GACAL;GACJ,CAAA;EAEA,MAAMiB,oBAAoB,IAAInE,8BAA8B;GACxDoE,iBAAiB,IAAIxD,uBAAuB;IACxCuC,YAAYhB,UAAUE,QAA2BtD,YAAAA;IACjDkE;IACJ,CAAA;GACAoB,qBAAqB,IAAIxD,2BACrBsB,UAAUE,QAA+BpD,gBAAAA,CAAAA;GAE7CqF,2BAA2B,IAAI3D,iCAC3BwB,UAAUE,QAAqCrD,sBAAAA,CAAAA;GAGnDuE;GACAL;GACJ,CAAA;EAEA,MAAMqB,oBAAoB,IAAIrE,8BAA8B,EACxDiD,YAAY,IAAInC,uBAAuB;GACnCmC,YAAYhB,UAAUE,QAA2BjD,YAAAA;GACjD6D;GACJ,CAAA,EACJ,CAAA;AAqBA,QAAMwB,IARuB7E,8BAA8B;GACvD0D;GACAG;GACAC;GACAc,mBAAAA,IAf0BzE,8BAA8B;IACxDoD,YAAY,IAAIzC,uBAAuBuC,gBAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAI;IACAI;IACJ,CAMIC;GACAD;GACJ,CAEME,CAAiBC,YAAY7B,KAAAA;AAEnC,MAAIT,OAAOuC,mCACP,OAAM,KAAKC,oBAAoB7B,YAAYK,iBAAAA;;CAInD,MAAgBwB,oBACZ7B,YACAK,kBACa;EACb,MAAMyB,gBAAgB,MAAMzB,iBAAiB0B,cAAcvF,iBAAiBwF,QAAO;AACnF,MAAI,CAACF,cACD;EAGJ,MAAMG,iBAAiBjC,WAAWkC,cAAcpG,iBAAAA;EAChD,MAAMqG,eAAenC,WAAWkC,cAAczF,uBAAAA;EAE9C,MAAM2F,cAAc,MAAMH,eAAeI,MAAI;AAC7C,OAAK,MAAMC,cAAcF,YAGrB,KAAI,CAACG,MAFsBJ,aAAaK,UAAU,EAAEC,eAAeH,WAAWI,IAAG,CAAA,CAG7E,OAAMP,aAAaQ,KAAKR,aAAaS,OAAO;GACxCH,eAAeH,WAAWI;GAC1BG,qBAAqBP,WAAWQ;GAChCC,WAAWjB,cAAcY;GACzBM,iBAAiBlB,cAAcgB;GACnC,CAAA,CAAA"}
1	+ {"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RobotEntity","RobotPermissionEntity","RobotRoleEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RobotProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RobotPermissionRepositoryAdapter","RobotRepositoryAdapter","RobotRoleRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","robotSynchronizer","robotRepository","robotRoleRepository","robotPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","find","permission","hasAnyPolicy","findOneBy","permission_id","id","save","create","permission_realm_id","realm_id","policy_id","policy_realm_id"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n Client,\n ClientPermission,\n ClientRole,\n PermissionPolicy,\n Realm,\n Robot,\n RobotPermission,\n RobotRole,\n Role,\n RolePermission,\n Scope,\n UserPermission,\n UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n ClientEntity,\n ClientPermissionEntity,\n ClientRoleEntity,\n PermissionEntity,\n RealmEntity,\n RobotEntity,\n RobotPermissionEntity,\n RobotRoleEntity,\n RoleEntity,\n RolePermissionEntity,\n ScopeEntity,\n UserPermissionEntity,\n UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n PermissionPolicyEntity,\n PolicyRepository,\n UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n ClientProvisioningSynchronizer,\n GraphProvisioningSynchronizer,\n PermissionProvisioningSynchronizer,\n PolicyProvisioningSynchronizer,\n RealmProvisioningSynchronizer,\n RobotProvisioningSynchronizer,\n RoleProvisioningSynchronizer,\n ScopeProvisioningSynchronizer,\n UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n ClientPermissionRepositoryAdapter,\n ClientRepositoryAdapter,\n ClientRoleRepositoryAdapter,\n PermissionPolicyRepositoryAdapter,\n PermissionRepositoryAdapter,\n PolicyRepositoryAdapter,\n RealmRepositoryAdapter,\n RobotPermissionRepositoryAdapter,\n RobotRepositoryAdapter,\n RobotRoleRepositoryAdapter,\n RolePermissionRepositoryAdapter,\n RoleRepositoryAdapter,\n ScopeRepositoryAdapter,\n UserPermissionRepositoryAdapter,\n UserRepositoryAdapter,\n UserRoleRepositoryAdapter,\n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n protected sources: IProvisioningSource[];\n\n constructor(sources: IProvisioningSource[] = []) {\n this.name = ModuleName.PROVISIONING;\n this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n this.sources = sources;\n }\n\n async setup(container: IContainer): Promise<void> {\n const sources = [...this.sources];\n\n const config = container.resolve(ConfigInjectionKey);\n const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n if (fs.existsSync(provisioningDir)) {\n sources.push(new FileProvisioningSource({ cwd: provisioningDir }));\n }\n\n const composite = new CompositeProvisioningSource(sources);\n const data = await composite.load(container);\n\n const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n const permissionRepository = new PermissionRepositoryAdapter({\n repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n realmRepository,\n });\n\n const policyRepository = new PolicyRepositoryAdapter({\n repository: new PolicyRepository(dataSource),\n realmRepository,\n });\n\n // ---------------------------------------------------------------\n // Synchronize all entities (policies → permissions → roles → ...)\n // ---------------------------------------------------------------\n\n const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n );\n\n const policySynchronizer = new PolicyProvisioningSynchronizer({\n repository: policyRepository,\n permissionPolicyRepository,\n });\n\n const roleRepository = new RoleRepositoryAdapter({\n repository: container.resolve<Repository<Role>>(RoleEntity),\n realmRepository,\n });\n const clientRepository = new ClientRepositoryAdapter({\n repository: container.resolve<Repository<Client>>(ClientEntity),\n realmRepository,\n });\n\n const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n repository: permissionRepository,\n policyRepository,\n permissionPolicyRepository,\n });\n\n const roleSynchronizer = new RoleProvisioningSynchronizer({\n repository: roleRepository,\n permissionRepository,\n policyRepository,\n rolePermissionRepository: new RolePermissionRepositoryAdapter(\n container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n ),\n });\n\n const clientSynchronizer = new ClientProvisioningSynchronizer({\n clientRepository,\n clientRoleRepository: new ClientRoleRepositoryAdapter(\n container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n ),\n clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n\n roleSynchronizer,\n permissionSynchronizer,\n });\n\n const userSynchronizer = new UserProvisioningSynchronizer({\n userRepository: new UserRepositoryAdapter({\n repository: new UserRepository(dataSource),\n realmRepository,\n }),\n userRoleRepository: new UserRoleRepositoryAdapter(\n container.resolve<Repository<UserRole>>(UserRoleEntity),\n ),\n userPermissionRepository: new UserPermissionRepositoryAdapter(\n container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n ),\n\n clientRepository,\n roleRepository,\n permissionRepository,\n });\n\n const robotSynchronizer = new RobotProvisioningSynchronizer({\n robotRepository: new RobotRepositoryAdapter({\n repository: container.resolve<Repository<Robot>>(RobotEntity),\n realmRepository,\n }),\n robotRoleRepository: new RobotRoleRepositoryAdapter(\n container.resolve<Repository<RobotRole>>(RobotRoleEntity),\n ),\n robotPermissionRepository: new RobotPermissionRepositoryAdapter(\n container.resolve<Repository<RobotPermission>>(RobotPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n });\n\n const scopeRepository = new ScopeRepositoryAdapter({\n repository: container.resolve<Repository<Scope>>(ScopeEntity),\n realmRepository,\n });\n\n const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n const realmSynchronizer = new RealmProvisioningSynchronizer({\n repository: new RealmRepositoryAdapter(realmRepository),\n\n clientSynchronizer,\n roleSynchronizer,\n permissionSynchronizer,\n userSynchronizer,\n robotSynchronizer,\n scopeSynchronizer,\n });\n\n const rootSynchronizer = new GraphProvisioningSynchronizer({\n policySynchronizer,\n permissionSynchronizer,\n roleSynchronizer,\n realmSynchronizer,\n scopeSynchronizer,\n });\n\n await rootSynchronizer.synchronize(data);\n\n if (config.permissionsDefaultPolicyAssignment) {\n await this.assignDefaultPolicy(dataSource, policyRepository);\n }\n }\n\n protected async assignDefaultPolicy(\n dataSource: DataSource,\n policyRepository: PolicyRepositoryAdapter,\n ): Promise<void> {\n const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n if (!defaultPolicy) {\n return;\n }\n\n const permissionRepo = dataSource.getRepository(PermissionEntity);\n const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n const permissions = await permissionRepo.find();\n for (const permission of permissions) {\n const hasAnyPolicy = await junctionRepo.findOneBy({ permission_id: permission.id });\n\n if (!hasAnyPolicy) {\n await junctionRepo.save(junctionRepo.create({\n permission_id: permission.id,\n permission_realm_id: permission.realm_id,\n policy_id: defaultPolicy.id,\n policy_realm_id: defaultPolicy.realm_id,\n }));\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,IAAaiD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,EAAE,EAAE;AAC7C,OAAKF,OAAOP,WAAWU;AACvB,OAAKF,eAAe,CAACR,WAAWW,QAAQX,WAAWY,SAAS;AAC5D,OAAKH,UAAUA;;CAGnB,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,QAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQb,mBAAAA;EACjC,MAAMc,kBAAkBf,KAAKgB,KAAKH,OAAOI,uBAAuB,eAAA;AAChE,MAAIlB,GAAGmB,WAAWH,gBAAAA,CACdR,SAAQY,KAAK,IAAIhB,uBAAuB,EAAEiB,KAAKL,iBAAgB,CAAA,CAAA;EAInE,MAAMO,OAAO,MAAMD,IADGnB,4BAA4BK,QAC/Bc,CAAUE,KAAKX,UAAAA;EAElC,MAAMY,aAAaZ,UAAUE,QAAQjB,qBAAqB4B,WAAU;EACpE,MAAMC,kBAAkBd,UAAUE,QAA2BvD,YAAAA;EAE7D,MAAMoE,uBAAuB,IAAI1C,4BAA4B;GACzD2C,YAAYhB,UAAUE,QAAsCxD,iBAAAA;GAC5DoE;GACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI3C,wBAAwB;GACjD0C,YAAY,IAAI1D,iBAAiBsD,WAAAA;GACjCE;GACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAI9C,kCACnC4B,UAAUE,QAAsC7C,uBAAAA,CAAAA;EAGpD,MAAM8D,qBAAqB,IAAIxD,+BAA+B;GAC1DqD,YAAYC;GACZC;GACJ,CAAA;EAEA,MAAME,iBAAiB,IAAIxC,sBAAsB;GAC7CoC,YAAYhB,UAAUE,QAA0BnD,WAAAA;GAChD+D;GACJ,CAAA;EACA,MAAMO,mBAAmB,IAAInD,wBAAwB;GACjD8C,YAAYhB,UAAUE,QAA4B3D,aAAAA;GAClDuE;GACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI5D,mCAAmC;GAClEsD,YAAYD;GACZE;GACAC;GACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAIzD,6BAA6B;GACtDkD,YAAYI;GACZL;GACAE;GACAO,0BAA0B,IAAI7C,gCAC1BqB,UAAUE,QAAoClD,qBAAAA,CAAAA;GAEtD,CAAA;EAEA,MAAMyE,qBAAqB,IAAIjE,+BAA+B;GAC1D6D;GACAK,sBAAsB,IAAIvD,4BACtB6B,UAAUE,QAAgCzD,iBAAAA,CAAAA;GAE9CkF,4BAA4B,IAAI1D,kCAC5B+B,UAAUE,QAAsC1D,uBAAAA,CAAAA;GAGpD4E;GACAL;GAEAQ;GACAD;GACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAI5D,6BAA6B;GACtD6D,gBAAgB,IAAI9C,sBAAsB;IACtCiC,YAAY,IAAIzD,eAAeqD,WAAAA;IAC/BE;IACJ,CAAA;GACAgB,oBAAoB,IAAI9C,0BACpBgB,UAAUE,QAA8B/C,eAAAA,CAAAA;GAE5C4E,0BAA0B,IAAIjD,gCAC1BkB,UAAUE,QAAoChD,qBAAAA,CAAAA;GAGlDmE;GACAD;GACAL;GACJ,CAAA;EAEA,MAAMiB,oBAAoB,IAAInE,8BAA8B;GACxDoE,iBAAiB,IAAIxD,uBAAuB;IACxCuC,YAAYhB,UAAUE,QAA2BtD,YAAAA;IACjDkE;IACJ,CAAA;GACAoB,qBAAqB,IAAIxD,2BACrBsB,UAAUE,QAA+BpD,gBAAAA,CAAAA;GAE7CqF,2BAA2B,IAAI3D,iCAC3BwB,UAAUE,QAAqCrD,sBAAAA,CAAAA;GAGnDuE;GACAL;GACJ,CAAA;EAOA,MAAMsB,oBAAoB,IAAItE,8BAA8B,EAAEiD,YAAYoB,IAL9CvD,uBAAuB;GAC/CmC,YAAYhB,UAAUE,QAA2BjD,YAAAA;GACjD6D;GACJ,CAE0EsB,EAAgB,CAAA;AAqB1F,QAAMG,IARuB9E,8BAA8B;GACvD0D;GACAG;GACAC;GACAe,mBAAAA,IAf0B1E,8BAA8B;IACxDoD,YAAY,IAAIzC,uBAAuBuC,gBAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAI;IACAK;IACJ,CAMIC;GACAD;GACJ,CAEME,CAAiBC,YAAY9B,KAAAA;AAEnC,MAAIT,OAAOwC,mCACP,OAAM,KAAKC,oBAAoB9B,YAAYK,iBAAAA;;CAInD,MAAgByB,oBACZ9B,YACAK,kBACa;EACb,MAAM0B,gBAAgB,MAAM1B,iBAAiB2B,cAAcxF,iBAAiByF,QAAO;AACnF,MAAI,CAACF,cACD;EAGJ,MAAMG,iBAAiBlC,WAAWmC,cAAcrG,iBAAAA;EAChD,MAAMsG,eAAepC,WAAWmC,cAAc1F,uBAAAA;EAE9C,MAAM4F,cAAc,MAAMH,eAAeI,MAAI;AAC7C,OAAK,MAAMC,cAAcF,YAGrB,KAAI,CAACG,MAFsBJ,aAAaK,UAAU,EAAEC,eAAeH,WAAWI,IAAG,CAAA,CAG7E,OAAMP,aAAaQ,KAAKR,aAAaS,OAAO;GACxCH,eAAeH,WAAWI;GAC1BG,qBAAqBP,WAAWQ;GAChCC,WAAWjB,cAAcY;GACzBM,iBAAiBlB,cAAcgB;GACnC,CAAA,CAAA"}

package/dist/app/modules/provisioning/sources/default/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;~~IA0E3C~~,gBAAgB,IAAI,4BAA4B,EAAE;~~IAclD~~,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IA4DhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA8F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAuI3C,gBAAgB,IAAI,4BAA4B,EAAE;IA6BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IA4DhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA8F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}

package/dist/app/modules/provisioning/sources/default/module.mjs CHANGED Viewed

@@ -76,20 +76,76 @@ var DefaultProvisioningSource = class {
 					attribute_null_match_all: true,
 					identity_master_match_all: false
 				}
+			},
+			{
+				attributes: {
+					name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,
+					type: BuiltInPolicyType.ATTRIBUTE_NAMES,
+					invert: true,
+					built_in: true,
+					realm_id: null
+				},
+				extraAttributes: { names: [
+					"active",
+					"realm_id",
+					"is_confidential",
+					"secret_hashed",
+					"secret_encrypted"
+				] }
+			},
+			{
+				attributes: {
+					name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,
+					type: BuiltInPolicyType.ATTRIBUTE_NAMES,
+					invert: true,
+					built_in: true,
+					realm_id: null
+				},
+				extraAttributes: { names: [
+					"active",
+					"realm_id",
+					"user_id"
+				] }
+			},
+			{
+				attributes: {
+					name: SystemPolicyName.USER_NAMES_SELF_MANAGE,
+					type: BuiltInPolicyType.ATTRIBUTE_NAMES,
+					invert: true,
+					built_in: true,
+					realm_id: null
+				},
+				extraAttributes: { names: [
+					"active",
+					"name_locked",
+					"status",
+					"status_message",
+					"realm_id"
+				] }
 			}
 		];
 	}
 	buildPermissions() {
-		return Object.values(PermissionName).map((name) => ({
-			strategy: {
-				type: ProvisioningEntityStrategyType.MERGE,
-				attributes: ["built_in"]
-			},
-			attributes: {
-				name,
-				built_in: true
-			}
-		}));
+		const policiesByPermission = {
+			[PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],
+			[PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],
+			[PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE]
+		};
+		return Object.values(PermissionName).map((name) => {
+			const entity = {
+				strategy: {
+					type: ProvisioningEntityStrategyType.MERGE,
+					attributes: ["built_in"]
+				},
+				attributes: {
+					name,
+					built_in: true
+				}
+			};
+			const policies = policiesByPermission[name];
+			if (policies) entity.relations = { policies };
+			return entity;
+		});
 	}
 	buildScopes() {
 		return Object.values(ScopeName).map((name) => ({

package/dist/app/modules/provisioning/sources/default/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","DecisionStrategy","SystemPolicyName","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","REALM_MATCH","attribute_name","attribute_name_strict","identity_master_match_all","attribute_null_match_all","REALM_BOUND","REALM_OR_GLOBAL","buildPermissions","Object","values","map","strategy","MERGE","buildScopes","buildRoles","relations","globalPermissions","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","globalPermissionsPolicyName","globalPermissionsPolicyOverrides","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","is_confidential","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","policies","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, DecisionStrategy, SystemPolicyName } from '@authup/access';\nimport type {\n Client, \n Permission, \n Robot, \n Role, \n Scope, \n User,\n} from '@authup/core-kit';\nimport {\n PermissionName, \n REALM_MASTER_NAME, \n ROLE_ADMIN_NAME, \n ROLE_REALM_ADMIN_NAME, \n ScopeName, \n buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n ClientCredentialsService,\n RobotCredentialsService,\n UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n buildPolicies(): PolicyProvisioningEntity[] {\n return [\n {\n attributes: {\n name: SystemPolicyName.DEFAULT,\n type: BuiltInPolicyType.COMPOSITE,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n children: [\n {\n attributes: {\n name: SystemPolicyName.IDENTITY,\n type: BuiltInPolicyType.IDENTITY,\n built_in: true,\n realm_id: null,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.PERMISSION_BINDING,\n type: BuiltInPolicyType.PERMISSION_BINDING,\n built_in: true,\n realm_id: null,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_MATCH,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n identity_master_match_all: false,\n attribute_null_match_all: true,\n },\n },\n ],\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_BOUND,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n attribute_null_match_all: false,\n identity_master_match_all: false,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_OR_GLOBAL,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n attribute_null_match_all: true,\n identity_master_match_all: false,\n },\n },\n ];\n }\n\n buildPermissions(): PermissionProvisioningEntity[] {\n return Object.values(PermissionName)\n .map((name) => ({\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Permission)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n }));\n }\n\n buildScopes(): ScopeProvisioningEntity[] {\n return Object.values(ScopeName)\n .map((name) => ({\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Scope)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n }));\n }\n\n buildRoles(): RoleProvisioningEntity[] {\n return [\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_ADMIN_NAME,\n built_in: true,\n },\n relations: { globalPermissions: [''] },\n },\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_REALM_ADMIN_NAME,\n built_in: true,\n },\n relations: {\n globalPermissions: ['*'],\n globalPermissionsExclude: [\n PermissionName.REALM_CREATE,\n PermissionName.REALM_UPDATE,\n PermissionName.REALM_DELETE,\n ],\n globalPermissionsPolicyName: SystemPolicyName.REALM_OR_GLOBAL,\n globalPermissionsPolicyOverrides: {\n [SystemPolicyName.REALM_BOUND]: [\n PermissionName.CLIENT_CREATE,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n PermissionName.IDENTITY_PROVIDER_CREATE,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n PermissionName.PERMISSION_CREATE,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n PermissionName.ROBOT_CREATE,\n PermissionName.ROBOT_UPDATE,\n PermissionName.ROBOT_DELETE,\n PermissionName.ROLE_CREATE,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n PermissionName.SCOPE_CREATE,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n PermissionName.USER_CREATE,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ],\n },\n },\n },\n ];\n }\n\n async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n const masterRealm : RealmProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'],\n },\n attributes: {\n name: REALM_MASTER_NAME,\n built_in: true,\n },\n relations: {},\n };\n\n const userCredentialsService = new UserCredentialsService();\n\n let userStrategy : ProvisioningEntityStrategy<User> \| undefined;\n if (config.userAdminPasswordReset) {\n userStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['password'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.users = [\n {\n strategy: userStrategy,\n attributes: {\n name: 'admin',\n password: await userCredentialsService.protect(config.userAdminPassword),\n email: buildUserFakeEmail('admin'),\n active: config.userAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const clientCredentialsService = new ClientCredentialsService();\n\n let clientStrategy : ProvisioningEntityStrategy<Client> \| undefined;\n if (config.clientSystemSecretReset) {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'is_confidential', 'secret', 'secret_hashed', 'secret_encrypted'],\n };\n } else {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'is_confidential'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.clients = [\n {\n strategy: clientStrategy,\n attributes: {\n built_in: true,\n is_confidential: true,\n name: 'system',\n secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n secret_hashed: false,\n active: config.clientSystemEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const robotCredentialsService = new RobotCredentialsService();\n\n let robotStrategy : ProvisioningEntityStrategy<Robot> \| undefined;\n if (config.robotAdminSecretReset) {\n robotStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['secret'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.robots = [\n {\n strategy: robotStrategy,\n attributes: {\n name: 'system',\n secret: await robotCredentialsService.protect(config.robotAdminSecret),\n active: config.robotAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n return [masterRealm];\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const config = container.resolve(ConfigInjectionKey);\n\n return {\n policies: this.buildPolicies(),\n permissions: this.buildPermissions(),\n scopes: this.buildScopes(),\n roles: this.buildRoles(),\n realms: await this.buildRealms(config),\n };\n }\n}\n"],"mappings":";;;;;;;;;;;AA0CA,IAAac,4BAAb,MAAaA;CACTC,gBAA4C;AACxC,SAAO;GACH;IACIC,YAAY;KACRC,MAAMf,iBAAiBgB;KACvBC,MAAMnB,kBAAkBoB;KACxBC,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB,EAAEC,mBAAmBvB,iBAAiBwB,WAAU;IACjEC,UAAU;KACN,EACIV,YAAY;MACRC,MAAMf,iBAAiByB;MACvBR,MAAMnB,kBAAkB2B;MACxBN,UAAU;MACVC,UAAU;MACd,EACJ;KACA,EACIN,YAAY;MACRC,MAAMf,iBAAiB0B;MACvBT,MAAMnB,kBAAkB4B;MACxBP,UAAU;MACVC,UAAU;MACd,EACJ;KACA;MACIN,YAAY;OACRC,MAAMf,iBAAiB2B;OACvBV,MAAMnB,kBAAkB6B;OACxBR,UAAU;OACVC,UAAU;OACd;MACAC,iBAAiB;OACbO,gBAAgB,CAAC,WAAW;OAC5BC,uBAAuB;OACvBC,2BAA2B;OAC3BC,0BAA0B;OAC9B;MACJ;KACH;IACL;GACA;IACIjB,YAAY;KACRC,MAAMf,iBAAiBgC;KACvBf,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,WAAW;KAC5BC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;KAC/B;IACJ;GACA;IACIhB,YAAY;KACRC,MAAMf,iBAAiBiC;KACvBhB,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,WAAW;KAC5BC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;KAC/B;IACJ;GACH;;CAGLI,mBAAmD;AAC/C,SAAOC,OAAOC,OAAOnC,eAAAA,CAChBoC,KAAKtB,UAAU;GACZuB,UAAU;IACNrB,MAAMN,+BAA+B4B;IACrCzB,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC;IACAI,UAAU;IACd;GACJ,EAAA;;CAGRqB,cAAyC;AACrC,SAAOL,OAAOC,OAAO/B,UAAAA,CAChBgC,KAAKtB,UAAU;GACZuB,UAAU;IACNrB,MAAMN,+BAA+B4B;IACrCzB,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC;IACAI,UAAU;IACd;GACJ,EAAA;;CAGRsB,aAAuC;AACnC,SAAO,CACH;GACIH,UAAU;IACNrB,MAAMN,+BAA+B4B;IACrCzB,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;IACd;GACAuB,WAAW,EAAEC,mBAAmB,CAAC,IAAI,EAAC;GAC1C,EACA;GACIL,UAAU;IACNrB,MAAMN,+BAA+B4B;IACrCzB,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;IACd;GACAuB,WAAW;IACPC,mBAAmB,CAAC,IAAI;IACxBC,0BAA0B;KACtB3C,eAAe4C;KACf5C,eAAe6C;KACf7C,eAAe8C;KAClB;IACDC,6BAA6BhD,iBAAiBiC;IAC9CgB,kCAAkC,GAC7BjD,iBAAiBgC,cAAc;KAC5B/B,eAAeiD;KACfjD,eAAekD;KACflD,eAAemD;KACfnD,eAAeoD;KACfpD,eAAeqD;KACfrD,eAAesD;KACftD,eAAeuD;KACfvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KAClB,EACL;IACJ;GACJ,CACH;;CAGL,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1CnC,UAAU;IACNrB,MAAMN,+BAA+B4B;IACrCzB,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;IACd;GACAuB,WAAW,EAAC;GAChB;EAEA,MAAMgC,yBAAyB,IAAIjE,wBAAAA;EAEnC,IAAIkE;AACJ,MAAIH,OAAOI,uBACPD,gBAAe;GACX1D,MAAMN,+BAA+B4B;GACrCzB,YAAY,CAAC,WAAW;GAC5B;AAGJ2D,cAAY/B,YAAY+B,YAAY/B,aAAa,EAAC;AAClD+B,cAAY/B,UAAUmC,QAAQ,CAC1B;GACIvC,UAAUqC;GACV7D,YAAY;IACRC,MAAM;IACN+D,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,kBAAiB;IACvEC,OAAO3E,mBAAmB,QAAA;IAC1B4E,QAAQV,OAAOW;IACnB;GACAzC,WAAW,EAAE0C,aAAa,CAACjF,gBAAgB,EAAC;GAChD,CACH;EAED,MAAMkF,2BAA2B,IAAI9E,0BAAAA;EAErC,IAAI+E;AACJ,MAAId,OAAOe,wBACPD,kBAAiB;GACbrE,MAAMN,+BAA+B4B;GACrCzB,YAAY;IAAC;IAAY;IAAmB;IAAU;IAAiB;IAAmB;GAC9F;MAEAwE,kBAAiB;GACbrE,MAAMN,+BAA+B4B;GACrCzB,YAAY,CAAC,YAAY,kBAAkB;GAC/C;AAGJ2D,cAAY/B,YAAY+B,YAAY/B,aAAa,EAAC;AAClD+B,cAAY/B,UAAU8C,UAAU,CAC5B;GACIlD,UAAUgD;GACVxE,YAAY;IACRK,UAAU;IACVsE,iBAAiB;IACjB1E,MAAM;IACN2E,QAAQ,MAAML,yBAAyBN,QAAQP,OAAOmB,oBAAoB,EAAEC,eAAe,OAAM,CAAA;IACjGA,eAAe;IACfV,QAAQV,OAAOqB;IACnB;GACAnD,WAAW,EAAE0C,aAAa,CAACjF,gBAAgB,EAAC;GAChD,CACH;EAED,MAAM2F,0BAA0B,IAAItF,yBAAAA;EAEpC,IAAIuF;AACJ,MAAIvB,OAAOwB,sBACPD,iBAAgB;GACZ9E,MAAMN,+BAA+B4B;GACrCzB,YAAY,CAAC,SAAS;GAC1B;AAGJ2D,cAAY/B,YAAY+B,YAAY/B,aAAa,EAAC;AAClD+B,cAAY/B,UAAUuD,SAAS,CAC3B;GACI3D,UAAUyD;GACVjF,YAAY;IACRC,MAAM;IACN2E,QAAQ,MAAMI,wBAAwBf,QAAQP,OAAO0B,iBAAgB;IACrEhB,QAAQV,OAAO2B;IACnB;GACAzD,WAAW,EAAE0C,aAAa,CAACjF,gBAAgB,EAAC;GAChD,CACH;AAED,SAAO,CAACsE,YAAY;;CAGxB,MAAM2B,KAAKC,WAAwD;EAC/D,MAAM7B,SAAS6B,UAAUC,QAAQ5F,mBAAAA;AAEjC,SAAO;GACH6F,UAAU,KAAK1F,eAAa;GAC5B2F,aAAa,KAAKtE,kBAAgB;GAClCuE,QAAQ,KAAKjE,aAAW;GACxBkE,OAAO,KAAKjE,YAAU;GACtBkE,QAAQ,MAAM,KAAKpC,YAAYC,OAAAA;GACnC"}
1	+ {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","DecisionStrategy","SystemPolicyName","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","REALM_MATCH","attribute_name","attribute_name_strict","identity_master_match_all","attribute_null_match_all","REALM_BOUND","REALM_OR_GLOBAL","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","ROBOT_NAMES_SELF_MANAGE","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","ROBOT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","globalPermissionsPolicyName","globalPermissionsPolicyOverrides","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","is_confidential","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, DecisionStrategy, SystemPolicyName } from '@authup/access';\nimport type {\n Client, \n Permission, \n Robot, \n Role, \n Scope, \n User,\n} from '@authup/core-kit';\nimport {\n PermissionName, \n REALM_MASTER_NAME, \n ROLE_ADMIN_NAME, \n ROLE_REALM_ADMIN_NAME, \n ScopeName, \n buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n ClientCredentialsService,\n RobotCredentialsService,\n UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n buildPolicies(): PolicyProvisioningEntity[] {\n return [\n {\n attributes: {\n name: SystemPolicyName.DEFAULT,\n type: BuiltInPolicyType.COMPOSITE,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n children: [\n {\n attributes: {\n name: SystemPolicyName.IDENTITY,\n type: BuiltInPolicyType.IDENTITY,\n built_in: true,\n realm_id: null,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.PERMISSION_BINDING,\n type: BuiltInPolicyType.PERMISSION_BINDING,\n built_in: true,\n realm_id: null,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_MATCH,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n identity_master_match_all: false,\n attribute_null_match_all: true,\n },\n },\n ],\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_BOUND,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n attribute_null_match_all: false,\n identity_master_match_all: false,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_OR_GLOBAL,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n attribute_null_match_all: true,\n identity_master_match_all: false,\n },\n },\n // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n // Each `names` entry is what self-edit must REJECT; everything else\n // is permitted. New columns added to the entity are self-editable\n // by default — extend the denylist when adding admin-only state.\n {\n attributes: {\n name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n // FK + lifecycle\n 'active',\n 'realm_id',\n // Security-critical: a self-edit must not change the\n // client's confidentiality (toggling this clears the\n // secret) or downgrade the secret-storage format\n // (which would persist the secret in plaintext).\n 'is_confidential',\n 'secret_hashed',\n 'secret_encrypted',\n ],\n },\n },\n {\n attributes: {\n name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n 'active',\n 'realm_id',\n 'user_id',\n ],\n },\n },\n {\n attributes: {\n name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n 'active',\n 'name_locked',\n 'status',\n 'status_message',\n 'realm_id',\n ],\n },\n },\n ];\n }\n\n buildPermissions(): PermissionProvisioningEntity[] {\n const policiesByPermission: Partial<Record<string, string[]>> = {\n [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n [PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],\n [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n };\n\n return Object.values(PermissionName)\n .map((name) => {\n const entity: PermissionProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Permission)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n };\n\n const policies = policiesByPermission[name];\n if (policies) {\n entity.relations = { policies };\n }\n\n return entity;\n });\n }\n\n buildScopes(): ScopeProvisioningEntity[] {\n return Object.values(ScopeName)\n .map((name) => ({\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Scope)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n }));\n }\n\n buildRoles(): RoleProvisioningEntity[] {\n return [\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_ADMIN_NAME,\n built_in: true,\n },\n relations: { globalPermissions: [''] },\n },\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_REALM_ADMIN_NAME,\n built_in: true,\n },\n relations: {\n globalPermissions: ['*'],\n globalPermissionsExclude: [\n PermissionName.REALM_CREATE,\n PermissionName.REALM_UPDATE,\n PermissionName.REALM_DELETE,\n ],\n globalPermissionsPolicyName: SystemPolicyName.REALM_OR_GLOBAL,\n globalPermissionsPolicyOverrides: {\n [SystemPolicyName.REALM_BOUND]: [\n PermissionName.CLIENT_CREATE,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n PermissionName.IDENTITY_PROVIDER_CREATE,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n PermissionName.PERMISSION_CREATE,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n PermissionName.ROBOT_CREATE,\n PermissionName.ROBOT_UPDATE,\n PermissionName.ROBOT_DELETE,\n PermissionName.ROLE_CREATE,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n PermissionName.SCOPE_CREATE,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n PermissionName.USER_CREATE,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ],\n },\n },\n },\n ];\n }\n\n async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n const masterRealm : RealmProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'],\n },\n attributes: {\n name: REALM_MASTER_NAME,\n built_in: true,\n },\n relations: {},\n };\n\n const userCredentialsService = new UserCredentialsService();\n\n let userStrategy : ProvisioningEntityStrategy<User> \| undefined;\n if (config.userAdminPasswordReset) {\n userStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['password'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.users = [\n {\n strategy: userStrategy,\n attributes: {\n name: 'admin',\n password: await userCredentialsService.protect(config.userAdminPassword),\n email: buildUserFakeEmail('admin'),\n active: config.userAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const clientCredentialsService = new ClientCredentialsService();\n\n let clientStrategy : ProvisioningEntityStrategy<Client> \| undefined;\n if (config.clientSystemSecretReset) {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'is_confidential', 'secret', 'secret_hashed', 'secret_encrypted'],\n };\n } else {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'is_confidential'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.clients = [\n {\n strategy: clientStrategy,\n attributes: {\n built_in: true,\n is_confidential: true,\n name: 'system',\n secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n secret_hashed: false,\n active: config.clientSystemEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const robotCredentialsService = new RobotCredentialsService();\n\n let robotStrategy : ProvisioningEntityStrategy<Robot> \| undefined;\n if (config.robotAdminSecretReset) {\n robotStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['secret'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.robots = [\n {\n strategy: robotStrategy,\n attributes: {\n name: 'system',\n secret: await robotCredentialsService.protect(config.robotAdminSecret),\n active: config.robotAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n return [masterRealm];\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const config = container.resolve(ConfigInjectionKey);\n\n return {\n policies: this.buildPolicies(),\n permissions: this.buildPermissions(),\n scopes: this.buildScopes(),\n roles: this.buildRoles(),\n realms: await this.buildRealms(config),\n };\n }\n}\n"],"mappings":";;;;;;;;;;;AA0CA,IAAac,4BAAb,MAAaA;CACTC,gBAA4C;AACxC,SAAO;GACH;IACIC,YAAY;KACRC,MAAMf,iBAAiBgB;KACvBC,MAAMnB,kBAAkBoB;KACxBC,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB,EAAEC,mBAAmBvB,iBAAiBwB,WAAU;IACjEC,UAAU;KACN,EACIV,YAAY;MACRC,MAAMf,iBAAiByB;MACvBR,MAAMnB,kBAAkB2B;MACxBN,UAAU;MACVC,UAAU;MACd,EACJ;KACA,EACIN,YAAY;MACRC,MAAMf,iBAAiB0B;MACvBT,MAAMnB,kBAAkB4B;MACxBP,UAAU;MACVC,UAAU;MACd,EACJ;KACA;MACIN,YAAY;OACRC,MAAMf,iBAAiB2B;OACvBV,MAAMnB,kBAAkB6B;OACxBR,UAAU;OACVC,UAAU;OACd;MACAC,iBAAiB;OACbO,gBAAgB,CAAC,WAAW;OAC5BC,uBAAuB;OACvBC,2BAA2B;OAC3BC,0BAA0B;OAC9B;MACJ;KACH;IACL;GACA;IACIjB,YAAY;KACRC,MAAMf,iBAAiBgC;KACvBf,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,WAAW;KAC5BC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;KAC/B;IACJ;GACA;IACIhB,YAAY;KACRC,MAAMf,iBAAiBiC;KACvBhB,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,WAAW;KAC5BC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;KAC/B;IACJ;GAKA;IACIhB,YAAY;KACRC,MAAMf,iBAAiBkC;KACvBjB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB,EACbgB,OAAO;KAEH;KACA;KAKA;KACA;KACA;KACH,EACL;IACJ;GACA;IACIvB,YAAY;KACRC,MAAMf,iBAAiBsC;KACvBrB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB,EACbgB,OAAO;KACH;KACA;KACA;KACH,EACL;IACJ;GACA;IACIvB,YAAY;KACRC,MAAMf,iBAAiBuC;KACvBtB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB,EACbgB,OAAO;KACH;KACA;KACA;KACA;KACA;KACH,EACL;IACJ;GACH;;CAGLG,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3DxC,eAAeyC,qBAAqB,CAAC1C,iBAAiBgB,SAAShB,iBAAiBkC,yBAAyB;IACzGjC,eAAe0C,oBAAoB,CAAC3C,iBAAiBgB,SAAShB,iBAAiBsC,wBAAwB;IACvGrC,eAAe2C,mBAAmB,CAAC5C,iBAAiBgB,SAAShB,iBAAiBuC,uBAAuB;GAC1G;AAEA,SAAOM,OAAOC,OAAO7C,eAAAA,CAChB8C,KAAKhC,SAAAA;GACF,MAAMiC,SAAuC;IACzCC,UAAU;KACNhC,MAAMN,+BAA+BuC;KACrCpC,YAAY,CAAC,WAAW;KAC5B;IACAA,YAAY;KACRC;KACAI,UAAU;KACd;IACJ;GAEA,MAAMgC,WAAWV,qBAAqB1B;AACtC,OAAIoC,SACAH,QAAOI,YAAY,EAAED,UAAS;AAGlC,UAAOH;IACX;;CAGRK,cAAyC;AACrC,SAAOR,OAAOC,OAAOzC,UAAAA,CAChB0C,KAAKhC,UAAU;GACZkC,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC;IACAI,UAAU;IACd;GACJ,EAAA;;CAGRmC,aAAuC;AACnC,SAAO,CACH;GACIL,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;IACd;GACAiC,WAAW,EAAEG,mBAAmB,CAAC,IAAI,EAAC;GAC1C,EACA;GACIN,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;IACd;GACAiC,WAAW;IACPG,mBAAmB,CAAC,IAAI;IACxBC,0BAA0B;KACtBvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KAClB;IACDC,6BAA6B5D,iBAAiBiC;IAC9C4B,kCAAkC,GAC7B7D,iBAAiBgC,cAAc;KAC5B/B,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;KACf/E,eAAegF;KACfhF,eAAeiF;KAClB,EACL;IACJ;GACJ,CACH;;CAGL,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1CpC,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;IACd;GACAiC,WAAW,EAAC;GAChB;EAEA,MAAMkC,yBAAyB,IAAI7E,wBAAAA;EAEnC,IAAI8E;AACJ,MAAIH,OAAOI,uBACPD,gBAAe;GACXtE,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,WAAW;GAC5B;AAGJuE,cAAYjC,YAAYiC,YAAYjC,aAAa,EAAC;AAClDiC,cAAYjC,UAAUqC,QAAQ,CAC1B;GACIxC,UAAUsC;GACVzE,YAAY;IACRC,MAAM;IACN2E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,kBAAiB;IACvEC,OAAOvF,mBAAmB,QAAA;IAC1BwF,QAAQV,OAAOW;IACnB;GACA3C,WAAW,EAAE4C,aAAa,CAAC7F,gBAAgB,EAAC;GAChD,CACH;EAED,MAAM8F,2BAA2B,IAAI1F,0BAAAA;EAErC,IAAI2F;AACJ,MAAId,OAAOe,wBACPD,kBAAiB;GACbjF,MAAMN,+BAA+BuC;GACrCpC,YAAY;IAAC;IAAY;IAAmB;IAAU;IAAiB;IAAmB;GAC9F;MAEAoF,kBAAiB;GACbjF,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,YAAY,kBAAkB;GAC/C;AAGJuE,cAAYjC,YAAYiC,YAAYjC,aAAa,EAAC;AAClDiC,cAAYjC,UAAUgD,UAAU,CAC5B;GACInD,UAAUiD;GACVpF,YAAY;IACRK,UAAU;IACVkF,iBAAiB;IACjBtF,MAAM;IACNuF,QAAQ,MAAML,yBAAyBN,QAAQP,OAAOmB,oBAAoB,EAAEC,eAAe,OAAM,CAAA;IACjGA,eAAe;IACfV,QAAQV,OAAOqB;IACnB;GACArD,WAAW,EAAE4C,aAAa,CAAC7F,gBAAgB,EAAC;GAChD,CACH;EAED,MAAMuG,0BAA0B,IAAIlG,yBAAAA;EAEpC,IAAImG;AACJ,MAAIvB,OAAOwB,sBACPD,iBAAgB;GACZ1F,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,SAAS;GAC1B;AAGJuE,cAAYjC,YAAYiC,YAAYjC,aAAa,EAAC;AAClDiC,cAAYjC,UAAUyD,SAAS,CAC3B;GACI5D,UAAU0D;GACV7F,YAAY;IACRC,MAAM;IACNuF,QAAQ,MAAMI,wBAAwBf,QAAQP,OAAO0B,iBAAgB;IACrEhB,QAAQV,OAAO2B;IACnB;GACA3D,WAAW,EAAE4C,aAAa,CAAC7F,gBAAgB,EAAC;GAChD,CACH;AAED,SAAO,CAACkF,YAAY;;CAGxB,MAAM2B,KAAKC,WAAwD;EAC/D,MAAM7B,SAAS6B,UAAUC,QAAQxG,mBAAAA;AAEjC,SAAO;GACHyC,UAAU,KAAKtC,eAAa;GAC5BsG,aAAa,KAAK3E,kBAAgB;GAClC4E,QAAQ,KAAK/D,aAAW;GACxBgE,OAAO,KAAK/D,YAAU;GACtBgE,QAAQ,MAAM,KAAKnC,YAAYC,OAAAA;GACnC"}

package/dist/components/database/unique-entries/module.mjs CHANGED Viewed

@@ -1,5 +1,5 @@
-import { PermissionEntity } from "../../../adapters/database/domains/permission/entity.mjs";
 import { RoleEntity } from "../../../adapters/database/domains/role/entity.mjs";
+import { PermissionEntity } from "../../../adapters/database/domains/permission/entity.mjs";
 import "../../../adapters/database/domains/index.mjs";
 //#region src/components/database/unique-entries/module.ts
 var DatabaseUniqueEntriesComponent = class {

package/dist/core/entities/client/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EACH,eAAe,EAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAmD5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IAiDZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;~~IAiHI~~,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EACH,eAAe,EAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAmD5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IAiDZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAwII,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}

package/dist/core/entities/client/service.mjs CHANGED Viewed

@@ -1,8 +1,8 @@
 import { ClientCredentialsService } from "../../authentication/credential/entities/client/module.mjs";
 import { AbstractEntityService } from "../service.mjs";
 import { ClientValidator, PermissionName, ValidatorGroup } from "@authup/core-kit";
-import { BuiltInPolicyType, PolicyData } from "@authup/access";
 import { isUUID } from "@authup/kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
 import { NotFoundError } from "@ebec/http";
 //#region src/core/entities/client/service.ts
 var ClientService = class extends AbstractEntityService {
@@ -98,8 +98,15 @@ var ClientService = class extends AbstractEntityService {
 			entity = await this.repository.findOneWithSecret(where);
 			if (!entity && options.updateOnly) throw new NotFoundError();
 		} else if (options.updateOnly) throw new NotFoundError();
+		let isSelfEdit = false;
 		if (entity) {
-			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });
+			try {
+				await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });
+			} catch (e) {
+				if (!actor.identity || actor.identity.type !== "client" || actor.identity.data.id !== entity.id) throw e;
+				isSelfEdit = true;
+				await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });
+			}
 			group = ValidatorGroup.UPDATE;
 		} else {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });
@@ -110,12 +117,16 @@ var ClientService = class extends AbstractEntityService {
 		await this.repository.checkUniqueness(validated, entity || void 0);
 		const credentialsService = new ClientCredentialsService();
 		if (entity) {
-			if (!validated.realm_id && !entity.realm_id) {
+			if (!isSelfEdit && !validated.realm_id && !entity.realm_id) {
 				const actorRealmId = this.getActorRealmId(actor);
 				if (actorRealmId) validated.realm_id = actorRealmId;
 			}
+			if (isSelfEdit) await actor.permissionEvaluator.evaluate({
+				name: PermissionName.CLIENT_SELF_MANAGE,
+				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+			});
 			entity = this.repository.merge(entity, validated);
-			await actor.permissionEvaluator.evaluate({
+			if (!isSelfEdit) await actor.permissionEvaluator.evaluate({
 				name: PermissionName.CLIENT_UPDATE,
 				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
 			});

package/dist/core/entities/client/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","isUUID","NotFoundError","ClientValidator","PermissionName","ValidatorGroup","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","input","ATTRIBUTES","push","getOne","idOrName","realmId","findOneByIdOrName","realm","resolve","findOneBy","realm_id","id","findOneByName","create","save","undefined","update","updateOnly","options","group","where","findOneWithSecret","preEvaluate","UPDATE","CLIENT_CREATE","CREATE","validated","run","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","merge","evaluate","is_confidential","generateSecret","protect","created","delete","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { isUUID } from '@authup/kit';\nimport { NotFoundError } from '@ebec/http';\nimport {\n ClientValidator,\n PermissionName,\n ValidatorGroup,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n const {\n data: entities, \n meta, \n } = await this.repository.findMany(query);\n let { total } = meta;\n\n const data: Client[] = [];\n for (const entity of entities) {\n if (\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n\n continue;\n }\n\n data.push(entity);\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n realmId?: string,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n let entity: Client \| null;\n\n if (isUUID(idOrName)) {\n entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n } else if (realmId) {\n const realm = await this.realmRepository.resolve(realmId);\n if (realm) {\n entity = await this.repository.findOneBy({\n name: idOrName,\n realm_id: realm.id,\n });\n } else {\n entity = null;\n }\n } else {\n entity = await this.repository.findOneByName(idOrName);\n }\n\n if (!entity) {\n throw new NotFoundError();\n }\n\n if (\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realm_id === 'string' ?\n await this.realmRepository.resolve(data.realm_id) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realm_id = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n if (!entity && options.updateOnly) {\n throw new NotFoundError();\n }\n } else if (options.updateOnly) {\n throw new NotFoundError();\n }\n\n if (entity) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !validated.realm_id &&\n !entity.realm_id\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n entity = this.repository.merge(entity, validated);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n if (entity.is_confidential) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realm_id) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.is_confidential) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new NotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;AA4BA,IAAaS,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;AACnC,SAAK;AACL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,kBAAkBE,IAAIF;AAC3B,OAAKC,YAAY,IAAIR,iBAAAA;;CAGzB,MAAMU,QACFC,OACAC,OAC+C;AAC/C,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,MAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,EAAE;AACzB,OAAK,MAAMK,UAAUJ,UAAU;AAC3B,OACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;AACE,QAAI;AACA,WAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFd,eAAee;OACff,eAAegB;OACfhB,eAAeiB;OAClB;MACDW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,QAAO,CAAA;MACnE,CAAA;AACAL,UAAKY,KAAKP,OAAAA;YACN;AACJD,cAAS;;AAGb;;AAGJJ,QAAKY,KAAKP,OAAAA;;AAGd,SAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;IACJ;GACJ;;CAGJ,MAAMS,OACFC,UACArB,OACAsB,SACe;AACf,QAAMtB,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;EAEA,IAAIM;AAEJ,MAAI1B,OAAOmC,SAAAA,CACPT,UAAS,MAAM,KAAKlB,WAAW6B,kBAAkBF,UAAUC,QAAAA;WACpDA,SAAS;GAChB,MAAME,QAAQ,MAAM,KAAK7B,gBAAgB8B,QAAQH,QAAAA;AACjD,OAAIE,MACAZ,UAAS,MAAM,KAAKlB,WAAWgC,UAAU;IACrCvB,MAAMkB;IACNM,UAAUH,MAAMI;IACpB,CAAA;OAEAhB,UAAS;QAGbA,UAAS,MAAM,KAAKlB,WAAWmC,cAAcR,SAAAA;AAGjD,MAAI,CAACT,OACD,OAAM,IAAIzB,eAAAA;AAGd,MACIyB,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,cAER,OAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAM;IACFd,eAAee;IACff,eAAegB;IACfhB,eAAeiB;IAClB;GACDW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,QAAO,CAAA;GACnE,CAAA;AAGJ,SAAOA;;CAGX,MAAMkB,OACFvB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKmB,KAAKC,KAAAA,GAAWzB,MAAMP,MAAAA;AACpD,SAAOY;;CAGX,MAAMqB,OACFZ,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKmB,KAAKV,UAAUd,MAAMP,OAAO,EAAEkC,YAAY,MAAK,CAAA;AAC7E,SAAOtB;;CAGX,MAAMmB,KACFV,UACAd,MACAP,OACAmC,UAAoC,EAAE,EAIvC;EACC,IAAIC;EAEJ,MAAMZ,QAAQ,OAAOjB,KAAKoB,aAAa,WACnC,MAAM,KAAKhC,gBAAgB8B,QAAQlB,KAAKoB,SAAQ,GAChDK,KAAAA;EAEJ,IAAIpB;AACJ,MAAIS,UAAU;GACV,MAAMgB,QAA6B,EAAC;AACpC,OAAInD,OAAOmC,SAAAA,CACPgB,OAAMT,KAAKP;OAEXgB,OAAMlC,OAAOkB;AAGjB,OAAIG,MACAa,OAAMV,WAAWH,MAAMI;AAG3BhB,YAAS,MAAM,KAAKlB,WAAW4C,kBAAkBD,MAAAA;AACjD,OAAI,CAACzB,UAAUuB,QAAQD,WACnB,OAAM,IAAI/C,eAAAA;aAEPgD,QAAQD,WACf,OAAM,IAAI/C,eAAAA;AAGd,MAAIyB,QAAQ;AACR,SAAMZ,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMd,eAAegB,eAAc,CAAA;AACjF+B,WAAQ9C,eAAekD;SACpB;AACH,SAAMxC,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMd,eAAeoD,eAAc,CAAA;AACjFL,WAAQ9C,eAAeoD;;EAG3B,MAAMC,YAAY,MAAM,KAAK/C,UAAUgD,IAAIrC,MAAM,EAAE6B,OAAM,CAAA;AAEzD,QAAM,KAAK1C,WAAWmD,oBAAoBF,UAAAA;AAC1C,QAAM,KAAKjD,WAAWoD,gBAAgBH,WAAW/B,UAAUoB,KAAAA,EAAAA;EAE3D,MAAMe,qBAAqB,IAAIvD,0BAAAA;AAE/B,MAAIoB,QAAQ;AACR,OACI,CAAC+B,UAAUhB,YACX,CAACf,OAAOe,UACV;IACE,MAAMqB,eAAe,KAAKC,gBAAgBjD,MAAAA;AAC1C,QAAIgD,aACAL,WAAUhB,WAAWqB;;AAI7BpC,YAAS,KAAKlB,WAAWwD,MAAMtC,QAAQ+B,UAAAA;AAEvC,SAAM3C,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMd,eAAegB;IACrBY,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,QAAO,CAAA;IACnE,CAAA;AAEA,OAAIA,OAAOwC,iBAAiB;AACxB,QAAI,CAACT,UAAU9B,UAAU,CAACD,OAAOC,OAC7B8B,WAAU9B,SAASkC,mBAAmBM,gBAAc;AAGxD,QAAIV,UAAU9B,OACVD,QAAOC,SAAS,MAAMkC,mBAAmBO,QAAQX,UAAU9B,QAAQD,OAAAA;SAGvEA,QAAOC,SAAS;AAGpB,SAAM,KAAKnB,WAAWqC,KAAKnB,OAAAA;AAE3B,UAAO;IACHA;IACA2C,SAAS;IACb;;AAGJ,MAAI,CAACZ,UAAUhB,UAAU;GACrB,MAAMqB,eAAe,KAAKC,gBAAgBjD,MAAAA;AAC1C,OAAIgD,aACAL,WAAUhB,WAAWqB;;AAI7B,QAAMhD,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMd,eAAeoD;GACrBxB,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAayB,WAAU,CAAA;GACtE,CAAA;AAEA/B,WAAS,KAAKlB,WAAWoC,OAAOa,UAAAA;AAEhC,MAAI/B,OAAOwC,iBAAiB;AACxB,OAAI,CAACT,UAAU9B,OACX8B,WAAU9B,SAASkC,mBAAmBM,gBAAc;AAGxDzC,UAAOC,SAAS,MAAMkC,mBAAmBO,QAAQX,UAAU9B,QAAQ8B,UAAAA;QAEnE/B,QAAOC,SAAS;AAGpB,QAAM,KAAKnB,WAAWqC,KAAKnB,OAAAA;AAE3B,SAAO;GACHA;GACA2C,SAAS;GACb;;CAGJ,MAAMC,OACF5B,IACA5B,OACe;AACf,QAAMA,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMd,eAAeiB,eAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWgC,UAAU,EAAEE,IAAG,CAAA;AACpD,MAAI,CAAChB,OACD,OAAM,IAAIzB,eAAAA;AAGd,QAAMa,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMd,eAAeiB;GACrBW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAEgB,IAAI6B,aAAa7C;AACzB,QAAM,KAAKlB,WAAWgE,OAAO9C,OAAAA;AAC7BA,SAAOgB,KAAK6B;AAEZ,SAAO7C"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","isUUID","NotFoundError","ClientValidator","PermissionName","ValidatorGroup","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","input","ATTRIBUTES","push","getOne","idOrName","realmId","findOneByIdOrName","realm","resolve","findOneBy","realm_id","id","findOneByName","create","save","undefined","update","updateOnly","options","group","where","findOneWithSecret","isSelfEdit","preEvaluate","e","identity","type","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","is_confidential","generateSecret","protect","created","delete","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { isUUID } from '@authup/kit';\nimport { NotFoundError } from '@ebec/http';\nimport {\n ClientValidator,\n PermissionName,\n ValidatorGroup,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n const {\n data: entities, \n meta, \n } = await this.repository.findMany(query);\n let { total } = meta;\n\n const data: Client[] = [];\n for (const entity of entities) {\n if (\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n\n continue;\n }\n\n data.push(entity);\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n realmId?: string,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n let entity: Client \| null;\n\n if (isUUID(idOrName)) {\n entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n } else if (realmId) {\n const realm = await this.realmRepository.resolve(realmId);\n if (realm) {\n entity = await this.repository.findOneBy({\n name: idOrName,\n realm_id: realm.id,\n });\n } else {\n entity = null;\n }\n } else {\n entity = await this.repository.findOneByName(idOrName);\n }\n\n if (!entity) {\n throw new NotFoundError();\n }\n\n if (\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realm_id === 'string' ?\n await this.realmRepository.resolve(data.realm_id) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realm_id = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n if (!entity && options.updateOnly) {\n throw new NotFoundError();\n }\n } else if (options.updateOnly) {\n throw new NotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'client' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n }\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !isSelfEdit &&\n !validated.realm_id &&\n !entity.realm_id\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SELF_MANAGE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n }\n\n if (entity.is_confidential) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realm_id) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.is_confidential) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new NotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;AA4BA,IAAaS,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;AACnC,SAAK;AACL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,kBAAkBE,IAAIF;AAC3B,OAAKC,YAAY,IAAIR,iBAAAA;;CAGzB,MAAMU,QACFC,OACAC,OAC+C;AAC/C,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,MAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,EAAE;AACzB,OAAK,MAAMK,UAAUJ,UAAU;AAC3B,OACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;AACE,QAAI;AACA,WAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFd,eAAee;OACff,eAAegB;OACfhB,eAAeiB;OAClB;MACDW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,QAAO,CAAA;MACnE,CAAA;AACAL,UAAKY,KAAKP,OAAAA;YACN;AACJD,cAAS;;AAGb;;AAGJJ,QAAKY,KAAKP,OAAAA;;AAGd,SAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;IACJ;GACJ;;CAGJ,MAAMS,OACFC,UACArB,OACAsB,SACe;AACf,QAAMtB,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;EAEA,IAAIM;AAEJ,MAAI1B,OAAOmC,SAAAA,CACPT,UAAS,MAAM,KAAKlB,WAAW6B,kBAAkBF,UAAUC,QAAAA;WACpDA,SAAS;GAChB,MAAME,QAAQ,MAAM,KAAK7B,gBAAgB8B,QAAQH,QAAAA;AACjD,OAAIE,MACAZ,UAAS,MAAM,KAAKlB,WAAWgC,UAAU;IACrCvB,MAAMkB;IACNM,UAAUH,MAAMI;IACpB,CAAA;OAEAhB,UAAS;QAGbA,UAAS,MAAM,KAAKlB,WAAWmC,cAAcR,SAAAA;AAGjD,MAAI,CAACT,OACD,OAAM,IAAIzB,eAAAA;AAGd,MACIyB,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,cAER,OAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAM;IACFd,eAAee;IACff,eAAegB;IACfhB,eAAeiB;IAClB;GACDW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,QAAO,CAAA;GACnE,CAAA;AAGJ,SAAOA;;CAGX,MAAMkB,OACFvB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKmB,KAAKC,KAAAA,GAAWzB,MAAMP,MAAAA;AACpD,SAAOY;;CAGX,MAAMqB,OACFZ,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKmB,KAAKV,UAAUd,MAAMP,OAAO,EAAEkC,YAAY,MAAK,CAAA;AAC7E,SAAOtB;;CAGX,MAAMmB,KACFV,UACAd,MACAP,OACAmC,UAAoC,EAAE,EAIvC;EACC,IAAIC;EAEJ,MAAMZ,QAAQ,OAAOjB,KAAKoB,aAAa,WACnC,MAAM,KAAKhC,gBAAgB8B,QAAQlB,KAAKoB,SAAQ,GAChDK,KAAAA;EAEJ,IAAIpB;AACJ,MAAIS,UAAU;GACV,MAAMgB,QAA6B,EAAC;AACpC,OAAInD,OAAOmC,SAAAA,CACPgB,OAAMT,KAAKP;OAEXgB,OAAMlC,OAAOkB;AAGjB,OAAIG,MACAa,OAAMV,WAAWH,MAAMI;AAG3BhB,YAAS,MAAM,KAAKlB,WAAW4C,kBAAkBD,MAAAA;AACjD,OAAI,CAACzB,UAAUuB,QAAQD,WACnB,OAAM,IAAI/C,eAAAA;aAEPgD,QAAQD,WACf,OAAM,IAAI/C,eAAAA;EAGd,IAAIoD,aAAa;AACjB,MAAI3B,QAAQ;AACR,OAAI;AACA,UAAMZ,MAAMC,oBAAoBuC,YAAY,EAAErC,MAAMd,eAAegB,eAAc,CAAA;YAC5EoC,GAAG;AACR,QACI,CAACzC,MAAM0C,YACP1C,MAAM0C,SAASC,SAAS,YACxB3C,MAAM0C,SAASnC,KAAKqB,OAAOhB,OAAOgB,GAElC,OAAMa;AAEVF,iBAAa;AACb,UAAMvC,MAAMC,oBAAoBuC,YAAY,EAAErC,MAAMd,eAAeuD,oBAAmB,CAAA;;AAE1FR,WAAQ9C,eAAeuD;SACpB;AACH,SAAM7C,MAAMC,oBAAoBuC,YAAY,EAAErC,MAAMd,eAAeyD,eAAc,CAAA;AACjFV,WAAQ9C,eAAeyD;;EAG3B,MAAMC,YAAY,MAAM,KAAKpD,UAAUqD,IAAI1C,MAAM,EAAE6B,OAAM,CAAA;AAEzD,QAAM,KAAK1C,WAAWwD,oBAAoBF,UAAAA;AAC1C,QAAM,KAAKtD,WAAWyD,gBAAgBH,WAAWpC,UAAUoB,KAAAA,EAAAA;EAE3D,MAAMoB,qBAAqB,IAAI5D,0BAAAA;AAE/B,MAAIoB,QAAQ;AACR,OACI,CAAC2B,cACD,CAACS,UAAUrB,YACX,CAACf,OAAOe,UACV;IACE,MAAM0B,eAAe,KAAKC,gBAAgBtD,MAAAA;AAC1C,QAAIqD,aACAL,WAAUrB,WAAW0B;;AAI7B,OAAId,WACA,OAAMvC,MAAMC,oBAAoBsD,SAAS;IACrCpD,MAAMd,eAAeuD;IACrB3B,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAa8B,WAAU,CAAA;IACtE,CAAA;AAGJpC,YAAS,KAAKlB,WAAW8D,MAAM5C,QAAQoC,UAAAA;AAEvC,OAAI,CAACT,WACD,OAAMvC,MAAMC,oBAAoBsD,SAAS;IACrCpD,MAAMd,eAAegB;IACrBY,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,QAAO,CAAA;IACnE,CAAA;AAGJ,OAAIA,OAAO6C,iBAAiB;AACxB,QAAI,CAACT,UAAUnC,UAAU,CAACD,OAAOC,OAC7BmC,WAAUnC,SAASuC,mBAAmBM,gBAAc;AAGxD,QAAIV,UAAUnC,OACVD,QAAOC,SAAS,MAAMuC,mBAAmBO,QAAQX,UAAUnC,QAAQD,OAAAA;SAGvEA,QAAOC,SAAS;AAGpB,SAAM,KAAKnB,WAAWqC,KAAKnB,OAAAA;AAE3B,UAAO;IACHA;IACAgD,SAAS;IACb;;AAGJ,MAAI,CAACZ,UAAUrB,UAAU;GACrB,MAAM0B,eAAe,KAAKC,gBAAgBtD,MAAAA;AAC1C,OAAIqD,aACAL,WAAUrB,WAAW0B;;AAI7B,QAAMrD,MAAMC,oBAAoBsD,SAAS;GACrCpD,MAAMd,eAAeyD;GACrB7B,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAa8B,WAAU,CAAA;GACtE,CAAA;AAEApC,WAAS,KAAKlB,WAAWoC,OAAOkB,UAAAA;AAEhC,MAAIpC,OAAO6C,iBAAiB;AACxB,OAAI,CAACT,UAAUnC,OACXmC,WAAUnC,SAASuC,mBAAmBM,gBAAc;AAGxD9C,UAAOC,SAAS,MAAMuC,mBAAmBO,QAAQX,UAAUnC,QAAQmC,UAAAA;QAEnEpC,QAAOC,SAAS;AAGpB,QAAM,KAAKnB,WAAWqC,KAAKnB,OAAAA;AAE3B,SAAO;GACHA;GACAgD,SAAS;GACb;;CAGJ,MAAMC,OACFjC,IACA5B,OACe;AACf,QAAMA,MAAMC,oBAAoBuC,YAAY,EAAErC,MAAMd,eAAeiB,eAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWgC,UAAU,EAAEE,IAAG,CAAA;AACpD,MAAI,CAAChB,OACD,OAAM,IAAIzB,eAAAA;AAGd,QAAMa,MAAMC,oBAAoBsD,SAAS;GACrCpD,MAAMd,eAAeiB;GACrBW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAEgB,IAAIkC,aAAalD;AACzB,QAAM,KAAKlB,WAAWqE,OAAOnD,OAAAA;AAC7BA,SAAOgB,KAAKkC;AAEZ,SAAOlD"}

package/dist/core/entities/client/types.d.ts CHANGED Viewed

@@ -1,9 +1,12 @@
-import type { Client } from '@authup/core-kit';
+import type { Client, Role } from '@authup/core-kit';
+import type { PermissionPolicyBinding } from '@authup/access';
 import type { ActorContext } from '../actor/types.ts';
 import type { EntityRepositoryFindManyResult, IEntityRepository } from '../types.ts';
 export interface IClientRepository extends IEntityRepository<Client> {
     checkUniqueness(data: Partial<Client>, existing?: Client): Promise<void>;
     findOneWithSecret(where: Record<string, any>): Promise<Client | null>;
+    getBoundRoles(entity: string | Client): Promise<Role[]>;
+    getBoundPermissions(entity: string | Client): Promise<PermissionPolicyBinding[]>;
 }
 export interface IClientService {
     getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<Client>>;

package/dist/core/entities/client/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;~~AAC/C~~,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,MAAM,CAAC;IAChE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;~~CACzE~~;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,MAAM,CAAC;IAChE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}

package/dist/core/entities/client-scope/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/service.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,oBAAoB,EAAkC,MAAM,kBAAkB,CAAC;AACxF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;CACtC,CAAC;AAEF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,GAAG,EAAE,yBAAyB;IAMpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;~~IAYjD~~,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;~~IAiBjB~~,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAkCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;CAmB1B"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/service.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,oBAAoB,EAAkC,MAAM,kBAAkB,CAAC;AACxF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;CACtC,CAAC;AAEF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,GAAG,EAAE,yBAAyB;IAMpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAajD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAkBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAkCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;CAmB1B"}