@authup/server-core 1.0.0-beta.37 → 1.0.0-beta.38

package/dist/core/entities/user/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","isUUID","removeObjectProperty","BadRequestError","NotFoundError","PermissionName","UserValidator","ValidatorGroup","AbstractEntityService","UserCredentialsService","UserService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_READ","USER_UPDATE","USER_DELETE","data","entities","meta","findMany","total","entity","identity","type","id","push","evaluateOneOf","input","ATTRIBUTES","getOne","idOrName","realmId","isMe","resolvedId","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneBy","hasAbility","preEvaluate","e","UPDATE","USER_CREATE","CREATE","validated","run","validateJoinColumns","credentialsService","originalName","originalNameLocked","name_locked","merge","evaluate","password","protect","created","actorRealmId","getActorRealmId","delete","entityId","remove"],"sources":["../../../../src/core/entities/user/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { isUUID, removeObjectProperty } from '@authup/kit';\nimport { BadRequestError, NotFoundError } from '@ebec/http';\nimport {\n    PermissionName,\n    UserValidator,\n    ValidatorGroup,\n} from '@authup/core-kit';\nimport type { User } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type { IUserRepository, IUserService } from './types.ts';\n\nexport type UserServiceContext = {\n    repository: IUserRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class UserService extends AbstractEntityService implements IUserService {\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: UserValidator;\n\n    constructor(ctx: UserServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new UserValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<User>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_READ,\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n\n        const data: User[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (\n                actor.identity &&\n                actor.identity.type === 'user' &&\n                actor.identity.data.id === entity.id\n            ) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: [\n                        PermissionName.USER_READ,\n                        PermissionName.USER_UPDATE,\n                        PermissionName.USER_DELETE,\n                    ],\n                    input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n                });\n\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<User> {\n        let isMe = false;\n        if (actor.identity && actor.identity.type === 'user') {\n            if (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            ) {\n                isMe = true;\n            }\n        }\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({\n                name: [\n                    PermissionName.USER_READ,\n                    PermissionName.USER_UPDATE,\n                    PermissionName.USER_DELETE,\n                ],\n            });\n        }\n\n        const resolvedId = isMe ? actor.identity!.data.id : idOrName;\n        const entity = await this.repository.findOne(resolvedId, query, realmId);\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        if (!isMe) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: [\n                    PermissionName.USER_READ,\n                    PermissionName.USER_UPDATE,\n                    PermissionName.USER_DELETE,\n                ],\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: User,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: User | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new NotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new NotFoundError();\n        }\n\n        let hasAbility: boolean | undefined;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n                hasAbility = true;\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'user' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n            }\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });\n            hasAbility = true;\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (!hasAbility) {\n            removeObjectProperty(validated, 'name_locked');\n            removeObjectProperty(validated, 'active');\n            removeObjectProperty(validated, 'status');\n            removeObjectProperty(validated, 'status_message');\n        }\n\n        const credentialsService = new UserCredentialsService();\n\n        if (entity) {\n            const originalName = entity.name;\n            const originalNameLocked = entity.name_locked;\n\n            entity = this.repository.merge(entity, validated);\n\n            if (\n                validated.name &&\n                validated.name !== originalName\n            ) {\n                if (validated.name_locked) {\n                    entity.name_locked = validated.name_locked;\n                }\n\n                if (originalNameLocked && validated.name_locked !== false) {\n                    entity.name = originalName;\n                }\n            }\n\n            if (hasAbility) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_UPDATE,\n                    input: new PolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: {\n                            ...entity,\n                            ...validated,\n                        },\n                    }),\n                });\n            }\n\n            if (validated.password) {\n                entity.password = await credentialsService.protect(validated.password);\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realm_id) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realm_id = actorRealmId;\n            }\n        }\n\n        entity = this.repository.create(validated);\n\n        if (hasAbility) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_CREATE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        }\n\n        if (validated.password) {\n            entity.password = await credentialsService.protect(validated.password);\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<User> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });\n\n        if (\n            actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === id\n        ) {\n            throw new BadRequestError('The own user can not be deleted.');\n        }\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;AA4BA,IAAaW,cAAb,cAAiCF,sBAAAA;CACnBG;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;AACjC,SAAK;AACL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,kBAAkBE,IAAIF;AAC3B,OAAKC,YAAY,IAAIP,eAAAA;;CAGzB,MAAMS,QACFC,OACAC,OAC6C;AAC7C,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;GAClB,EACL,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,MAAAA;EAEnC,MAAMQ,OAAe,EAAE;EACvB,IAAI,EAAEI,UAAUF;AAEhB,OAAK,MAAMG,UAAUJ,UAAU;AAC3B,OACIR,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,IACpC;AACER,SAAKS,KAAKJ,OAAAA;AACV;;AAGJ,OAAI;AACA,UAAMZ,MAAMC,oBAAoBgB,cAAc;KAC1Cd,MAAM;MACFf,eAAegB;MACfhB,eAAeiB;MACfjB,eAAekB;MAClB;KACDY,OAAO,IAAInC,WAAW,GAAGD,kBAAkBqC,aAAaP,QAAO,CAAA;KACnE,CAAA;AAEAL,SAAKS,KAAKJ,OAAAA;WACN;AACJD,aAAS;;;AAIjB,SAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;IACJ;GACJ;;CAGJ,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACa;EACb,IAAIC,OAAO;AACX,MAAIvB,MAAMa,YAAYb,MAAMa,SAASC,SAAS;OAEtCd,MAAMa,SAASN,KAAKQ,OAAOM,YAC3BrB,MAAMa,SAASN,KAAKJ,SAASkB,SAE7BE,QAAO;;AAIf,MAAI,CAACA,KACD,OAAMvB,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;GAClB,EACL,CAAA;EAGJ,MAAMkB,aAAaD,OAAOvB,MAAMa,SAAUN,KAAKQ,KAAKM;EACpD,MAAMT,SAAS,MAAM,KAAKlB,WAAW+B,QAAQD,YAAYzB,OAAOuB,QAAAA;AAChE,MAAI,CAACV,OACD,OAAM,IAAIzB,eAAAA;AAGd,MAAI,CAACoC,KACD,OAAMvB,MAAMC,oBAAoBgB,cAAc;GAC1Cd,MAAM;IACFf,eAAegB;IACfhB,eAAeiB;IACfjB,eAAekB;IAClB;GACDY,OAAO,IAAInC,WAAW,GAAGD,kBAAkBqC,aAAaP,QAAO,CAAA;GACnE,CAAA;AAGJ,SAAOA;;CAGX,MAAMc,OACFnB,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKC,KAAAA,GAAWrB,MAAMP,MAAAA;AACpD,SAAOY;;CAGX,MAAMiB,OACFR,UACAd,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKN,UAAUd,MAAMP,OAAO,EAAE8B,YAAY,MAAK,CAAA;AAC7E,SAAOlB;;CAGX,MAAMe,KACFN,UACAd,MACAP,OACA+B,UAAoC,EAAE,EAIvC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO1B,KAAK2B,aAAa,WACnC,MAAM,KAAKvC,gBAAgBwC,QAAQ5B,KAAK2B,SAAQ,GAChDN,KAAAA;EAEJ,IAAIhB;AACJ,MAAIS,UAAU;GACV,MAAMe,QAA6B,EAAC;AACpC,OAAIpD,OAAOqC,SAAAA,CACPe,OAAMrB,KAAKM;OAEXe,OAAMjC,OAAOkB;AAGjB,OAAIY,MACAG,OAAMF,WAAWD,MAAMlB;AAG3BH,YAAS,MAAM,KAAKlB,WAAW2C,UAAUD,MAAAA;AACzC,OAAI,CAACxB,UAAUmB,QAAQD,WACnB,OAAM,IAAI3C,eAAAA;aAEP4C,QAAQD,WACf,OAAM,IAAI3C,eAAAA;EAGd,IAAImD;AACJ,MAAI1B,QAAQ;AACR,OAAI;AACA,UAAMZ,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeiB,aAAY,CAAA;AAC/EiC,iBAAa;YACRE,GAAG;AACR,QACI,CAACxC,MAAMa,YACPb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,GAElC,OAAMyB;;AAIdR,WAAQ1C,eAAemD;SACpB;AACH,SAAMzC,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAesD,aAAY,CAAA;AAC/EJ,gBAAa;AAEbN,WAAQ1C,eAAeqD;;EAG3B,MAAMC,YAAY,MAAM,KAAKhD,UAAUiD,IAAItC,MAAM,EAAEyB,OAAM,CAAA;AAEzD,QAAM,KAAKtC,WAAWoD,oBAAoBF,UAAAA;AAE1C,MAAI,CAACN,YAAY;AACbrD,wBAAqB2D,WAAW,cAAA;AAChC3D,wBAAqB2D,WAAW,SAAA;AAChC3D,wBAAqB2D,WAAW,SAAA;AAChC3D,wBAAqB2D,WAAW,iBAAA;;EAGpC,MAAMG,qBAAqB,IAAIvD,wBAAAA;AAE/B,MAAIoB,QAAQ;GACR,MAAMoC,eAAepC,OAAOT;GAC5B,MAAM8C,qBAAqBrC,OAAOsC;AAElCtC,YAAS,KAAKlB,WAAWyD,MAAMvC,QAAQgC,UAAAA;AAEvC,OACIA,UAAUzC,QACVyC,UAAUzC,SAAS6C,cACrB;AACE,QAAIJ,UAAUM,YACVtC,QAAOsC,cAAcN,UAAUM;AAGnC,QAAID,sBAAsBL,UAAUM,gBAAgB,MAChDtC,QAAOT,OAAO6C;;AAItB,OAAIV,WACA,OAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMf,eAAeiB;IACrBa,OAAO,IAAInC,WAAW,GACjBD,kBAAkBqC,aAAa;KAC5B,GAAGP;KACH,GAAGgC;KACP,EACJ,CAAA;IACJ,CAAA;AAGJ,OAAIA,UAAUS,SACVzC,QAAOyC,WAAW,MAAMN,mBAAmBO,QAAQV,UAAUS,SAAQ;AAGzE,SAAM,KAAK3D,WAAWiC,KAAKf,OAAAA;AAE3B,UAAO;IACHA;IACA2C,SAAS;IACb;;AAGJ,MAAI,CAACX,UAAUV,UAAU;GACrB,MAAMsB,eAAe,KAAKC,gBAAgBzD,MAAAA;AAC1C,OAAIwD,aACAZ,WAAUV,WAAWsB;;AAI7B5C,WAAS,KAAKlB,WAAWgC,OAAOkB,UAAAA;AAEhC,MAAIN,WACA,OAAMtC,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAesD;GACrBxB,OAAO,IAAInC,WAAW,GAAGD,kBAAkBqC,aAAaP,QAAO,CAAA;GACnE,CAAA;AAGJ,MAAIgC,UAAUS,SACVzC,QAAOyC,WAAW,MAAMN,mBAAmBO,QAAQV,UAAUS,SAAQ;AAGzE,QAAM,KAAK3D,WAAWiC,KAAKf,OAAAA;AAE3B,SAAO;GACHA;GACA2C,SAAS;GACb;;CAGJ,MAAMG,OACF3C,IACAf,OACa;AACb,QAAMA,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAekB,aAAY,CAAA;AAE/E,MACIN,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOA,GAE3B,OAAM,IAAI7B,gBAAgB,mCAAA;EAG9B,MAAM0B,SAAS,MAAM,KAAKlB,WAAW2C,UAAU,EAAEtB,IAAG,CAAA;AACpD,MAAI,CAACH,OACD,OAAM,IAAIzB,eAAAA;AAGd,QAAMa,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAekB;GACrBY,OAAO,IAAInC,WAAW,GAAGD,kBAAkBqC,aAAaP,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAEG,IAAI4C,aAAa/C;AACzB,QAAM,KAAKlB,WAAWkE,OAAOhD,OAAAA;AAC7BA,SAAOG,KAAK4C;AAEZ,SAAO/C"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","isUUID","BadRequestError","NotFoundError","PermissionName","UserValidator","ValidatorGroup","AbstractEntityService","UserCredentialsService","UserService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_READ","USER_UPDATE","USER_DELETE","data","entities","meta","findMany","total","entity","identity","type","id","push","evaluateOneOf","input","ATTRIBUTES","getOne","idOrName","realmId","isMe","resolvedId","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneBy","isSelfEdit","preEvaluate","e","USER_SELF_MANAGE","UPDATE","USER_CREATE","CREATE","validated","run","validateJoinColumns","credentialsService","originalName","originalNameLocked","name_locked","evaluate","merge","password","protect","created","actorRealmId","getActorRealmId","delete","entityId","remove"],"sources":["../../../../src/core/entities/user/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { isUUID } from '@authup/kit';\nimport { BadRequestError, NotFoundError } from '@ebec/http';\nimport {\n    PermissionName,\n    UserValidator,\n    ValidatorGroup,\n} from '@authup/core-kit';\nimport type { User } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type { IUserRepository, IUserService } from './types.ts';\n\nexport type UserServiceContext = {\n    repository: IUserRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class UserService extends AbstractEntityService implements IUserService {\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: UserValidator;\n\n    constructor(ctx: UserServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new UserValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<User>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_READ,\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n\n        const data: User[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (\n                actor.identity &&\n                actor.identity.type === 'user' &&\n                actor.identity.data.id === entity.id\n            ) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: [\n                        PermissionName.USER_READ,\n                        PermissionName.USER_UPDATE,\n                        PermissionName.USER_DELETE,\n                    ],\n                    input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n                });\n\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<User> {\n        let isMe = false;\n        if (actor.identity && actor.identity.type === 'user') {\n            if (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            ) {\n                isMe = true;\n            }\n        }\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({\n                name: [\n                    PermissionName.USER_READ,\n                    PermissionName.USER_UPDATE,\n                    PermissionName.USER_DELETE,\n                ],\n            });\n        }\n\n        const resolvedId = isMe ? actor.identity!.data.id : idOrName;\n        const entity = await this.repository.findOne(resolvedId, query, realmId);\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        if (!isMe) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: [\n                    PermissionName.USER_READ,\n                    PermissionName.USER_UPDATE,\n                    PermissionName.USER_DELETE,\n                ],\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: User,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: User | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new NotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new NotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'user' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n            }\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const credentialsService = new UserCredentialsService();\n\n        if (entity) {\n            const originalName = entity.name;\n            const originalNameLocked = entity.name_locked;\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_SELF_MANAGE,\n                    input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (\n                validated.name &&\n                validated.name !== originalName\n            ) {\n                if (validated.name_locked) {\n                    entity.name_locked = validated.name_locked;\n                }\n\n                if (originalNameLocked && validated.name_locked !== false) {\n                    entity.name = originalName;\n                }\n            }\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_UPDATE,\n                    input: new PolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: {\n                            ...entity,\n                            ...validated,\n                        },\n                    }),\n                });\n            }\n\n            if (validated.password) {\n                entity.password = await credentialsService.protect(validated.password);\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realm_id) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realm_id = actorRealmId;\n            }\n        }\n\n        entity = this.repository.create(validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        if (validated.password) {\n            entity.password = await credentialsService.protect(validated.password);\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<User> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });\n\n        if (\n            actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === id\n        ) {\n            throw new BadRequestError('The own user can not be deleted.');\n        }\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;AA4BA,IAAaU,cAAb,cAAiCF,sBAAAA;CACnBG;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;AACjC,SAAK;AACL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,kBAAkBE,IAAIF;AAC3B,OAAKC,YAAY,IAAIP,eAAAA;;CAGzB,MAAMS,QACFC,OACAC,OAC6C;AAC7C,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;GAClB,EACL,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,MAAAA;EAEnC,MAAMQ,OAAe,EAAE;EACvB,IAAI,EAAEI,UAAUF;AAEhB,OAAK,MAAMG,UAAUJ,UAAU;AAC3B,OACIR,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,IACpC;AACER,SAAKS,KAAKJ,OAAAA;AACV;;AAGJ,OAAI;AACA,UAAMZ,MAAMC,oBAAoBgB,cAAc;KAC1Cd,MAAM;MACFf,eAAegB;MACfhB,eAAeiB;MACfjB,eAAekB;MAClB;KACDY,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaP,QAAO,CAAA;KACnE,CAAA;AAEAL,SAAKS,KAAKJ,OAAAA;WACN;AACJD,aAAS;;;AAIjB,SAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;IACJ;GACJ;;CAGJ,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACa;EACb,IAAIC,OAAO;AACX,MAAIvB,MAAMa,YAAYb,MAAMa,SAASC,SAAS;OAEtCd,MAAMa,SAASN,KAAKQ,OAAOM,YAC3BrB,MAAMa,SAASN,KAAKJ,SAASkB,SAE7BE,QAAO;;AAIf,MAAI,CAACA,KACD,OAAMvB,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;GAClB,EACL,CAAA;EAGJ,MAAMkB,aAAaD,OAAOvB,MAAMa,SAAUN,KAAKQ,KAAKM;EACpD,MAAMT,SAAS,MAAM,KAAKlB,WAAW+B,QAAQD,YAAYzB,OAAOuB,QAAAA;AAChE,MAAI,CAACV,OACD,OAAM,IAAIzB,eAAAA;AAGd,MAAI,CAACoC,KACD,OAAMvB,MAAMC,oBAAoBgB,cAAc;GAC1Cd,MAAM;IACFf,eAAegB;IACfhB,eAAeiB;IACfjB,eAAekB;IAClB;GACDY,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaP,QAAO,CAAA;GACnE,CAAA;AAGJ,SAAOA;;CAGX,MAAMc,OACFnB,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKC,KAAAA,GAAWrB,MAAMP,MAAAA;AACpD,SAAOY;;CAGX,MAAMiB,OACFR,UACAd,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKN,UAAUd,MAAMP,OAAO,EAAE8B,YAAY,MAAK,CAAA;AAC7E,SAAOlB;;CAGX,MAAMe,KACFN,UACAd,MACAP,OACA+B,UAAoC,EAAE,EAIvC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO1B,KAAK2B,aAAa,WACnC,MAAM,KAAKvC,gBAAgBwC,QAAQ5B,KAAK2B,SAAQ,GAChDN,KAAAA;EAEJ,IAAIhB;AACJ,MAAIS,UAAU;GACV,MAAMe,QAA6B,EAAC;AACpC,OAAInD,OAAOoC,SAAAA,CACPe,OAAMrB,KAAKM;OAEXe,OAAMjC,OAAOkB;AAGjB,OAAIY,MACAG,OAAMF,WAAWD,MAAMlB;AAG3BH,YAAS,MAAM,KAAKlB,WAAW2C,UAAUD,MAAAA;AACzC,OAAI,CAACxB,UAAUmB,QAAQD,WACnB,OAAM,IAAI3C,eAAAA;aAEP4C,QAAQD,WACf,OAAM,IAAI3C,eAAAA;EAGd,IAAImD,aAAa;AACjB,MAAI1B,QAAQ;AACR,OAAI;AACA,UAAMZ,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeiB,aAAY,CAAA;YAC1EmC,GAAG;AACR,QACI,CAACxC,MAAMa,YACPb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,GAElC,OAAMyB;AAEVF,iBAAa;AACb,UAAMtC,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeqD,kBAAiB,CAAA;;AAGxFT,WAAQ1C,eAAeoD;SACpB;AACH,SAAM1C,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeuD,aAAY,CAAA;AAE/EX,WAAQ1C,eAAesD;;EAG3B,MAAMC,YAAY,MAAM,KAAKjD,UAAUkD,IAAIvC,MAAM,EAAEyB,OAAM,CAAA;AAEzD,QAAM,KAAKtC,WAAWqD,oBAAoBF,UAAAA;EAE1C,MAAMG,qBAAqB,IAAIxD,wBAAAA;AAE/B,MAAIoB,QAAQ;GACR,MAAMqC,eAAerC,OAAOT;GAC5B,MAAM+C,qBAAqBtC,OAAOuC;AAElC,OAAIb,WACA,OAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMf,eAAeqD;IACrBvB,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAa0B,WAAU,CAAA;IACtE,CAAA;AAGJjC,YAAS,KAAKlB,WAAW2D,MAAMzC,QAAQiC,UAAAA;AAEvC,OACIA,UAAU1C,QACV0C,UAAU1C,SAAS8C,cACrB;AACE,QAAIJ,UAAUM,YACVvC,QAAOuC,cAAcN,UAAUM;AAGnC,QAAID,sBAAsBL,UAAUM,gBAAgB,MAChDvC,QAAOT,OAAO8C;;AAItB,OAAI,CAACX,WACD,OAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMf,eAAeiB;IACrBa,OAAO,IAAIlC,WAAW,GACjBD,kBAAkBoC,aAAa;KAC5B,GAAGP;KACH,GAAGiC;KACP,EACJ,CAAA;IACJ,CAAA;AAGJ,OAAIA,UAAUS,SACV1C,QAAO0C,WAAW,MAAMN,mBAAmBO,QAAQV,UAAUS,SAAQ;AAGzE,SAAM,KAAK5D,WAAWiC,KAAKf,OAAAA;AAE3B,UAAO;IACHA;IACA4C,SAAS;IACb;;AAGJ,MAAI,CAACX,UAAUX,UAAU;GACrB,MAAMuB,eAAe,KAAKC,gBAAgB1D,MAAAA;AAC1C,OAAIyD,aACAZ,WAAUX,WAAWuB;;AAI7B7C,WAAS,KAAKlB,WAAWgC,OAAOmB,UAAAA;AAEhC,QAAM7C,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAeuD;GACrBzB,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaP,QAAO,CAAA;GACnE,CAAA;AAEA,MAAIiC,UAAUS,SACV1C,QAAO0C,WAAW,MAAMN,mBAAmBO,QAAQV,UAAUS,SAAQ;AAGzE,QAAM,KAAK5D,WAAWiC,KAAKf,OAAAA;AAE3B,SAAO;GACHA;GACA4C,SAAS;GACb;;CAGJ,MAAMG,OACF5C,IACAf,OACa;AACb,QAAMA,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAekB,aAAY,CAAA;AAE/E,MACIN,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOA,GAE3B,OAAM,IAAI7B,gBAAgB,mCAAA;EAG9B,MAAM0B,SAAS,MAAM,KAAKlB,WAAW2C,UAAU,EAAEtB,IAAG,CAAA;AACpD,MAAI,CAACH,OACD,OAAM,IAAIzB,eAAAA;AAGd,QAAMa,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAekB;GACrBY,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaP,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAEG,IAAI6C,aAAahD;AACzB,QAAM,KAAKlB,WAAWmE,OAAOjD,OAAAA;AAC7BA,SAAOG,KAAK6C;AAEZ,SAAOhD"}

package/dist/core/entities/user/types.d.ts

@@ -1,10 +1,13 @@
-import type { User } from '@authup/core-kit';
+import type { Role, User } from '@authup/core-kit';
+import type { PermissionPolicyBinding } from '@authup/access';
 import type { ActorContext } from '../actor/types.ts';
 import type { EntityRepositoryFindManyResult, IEntityRepository } from '../types.ts';
 export interface IUserRepository extends IEntityRepository<User> {
     checkUniqueness(data: Partial<User>, existing?: User): Promise<void>;
     findOne(id: string, query?: Record<string, any>, realm?: string): Promise<User | null>;
     findOneByWithEmail(where: Record<string, any>): Promise<User | null>;
+    getBoundRoles(entity: string | User): Promise<Role[]>;
+    getBoundPermissions(entity: string | User): Promise<PermissionPolicyBinding[]>;
 }
 export interface IUserService {
     getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<User>>;

package/dist/core/entities/user/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,WAAW,eAAgB,SAAQ,iBAAiB,CAAC,IAAI,CAAC;IAC5D,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAEvF,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,YAAY;IACzB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC;IACxG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5G,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,WAAW,eAAgB,SAAQ,iBAAiB,CAAC,IAAI,CAAC;IAC5D,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAEvF,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAErE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAEtD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,YAAY;IACzB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC;IACxG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5G,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D"}

package/dist/core/entities/user-attribute/service.d.ts

@@ -5,15 +5,17 @@ import type { EntityRepositoryFindManyResult } from '../types.ts';
 import type { IUserAttributeRepository, IUserAttributeService } from './types.ts';
 export type UserAttributeServiceContext = {
     repository: IUserAttributeRepository;
+    reservedNames?: ReadonlySet<string>;
 };
 export declare class UserAttributeService extends AbstractEntityService implements IUserAttributeService {
     protected repository: IUserAttributeRepository;
+    protected reservedNames: ReadonlySet<string>;
     constructor(ctx: UserAttributeServiceContext);
     getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<UserAttribute>>;
     getOne(id: string, actor: ActorContext): Promise<UserAttribute>;
     create(data: Record<string, any>, actor: ActorContext): Promise<UserAttribute>;
     update(id: string, data: Record<string, any>, actor: ActorContext): Promise<UserAttribute>;
     delete(id: string, actor: ActorContext): Promise<UserAttribute>;
-    private canManageUserAttribute;
+    private canReadUserAttribute;
 }
 //# sourceMappingURL=service.d.ts.map

package/dist/core/entities/user-attribute/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-attribute/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAElF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,wBAAwB,CAAC;CACxC,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,qBAAsB,YAAW,qBAAqB;IAC5F,SAAS,CAAC,UAAU,EAAE,wBAAwB,CAAC;gBAEnC,GAAG,EAAE,2BAA2B;IAKtC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,aAAa,CAAC,CAAC;IAkCnD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAqBnB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAkCnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IA2BnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;YAyBX,sBAAsB;CAgCvC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-attribute/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAElF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,wBAAwB,CAAC;IACrC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,qBAAsB,YAAW,qBAAqB;IAC5F,SAAS,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAEjC,GAAG,EAAE,2BAA2B;IAMtC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,aAAa,CAAC,CAAC;IAkCnD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAqBnB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAwDnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IA8CnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;YAyBX,oBAAoB;CAuBrC"}

package/dist/core/entities/user-attribute/service.mjs

@@ -6,16 +6,18 @@ import { buildErrorMessageForAttribute } from "validup";
 //#region src/core/entities/user-attribute/service.ts
 var UserAttributeService = class extends AbstractEntityService {
 	repository;
+	reservedNames;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
+		this.reservedNames = ctx.reservedNames ?? /* @__PURE__ */ new Set();
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.USER_UPDATE, PermissionName.USER_SELF_MANAGE] });
 		const { data: entities, meta } = await this.repository.findMany(query);
 		const data = [];
 		let { total } = meta;
-		for (const entity of entities) if (await this.canManageUserAttribute(actor, entity)) data.push(entity);
+		for (const entity of entities) if (await this.canReadUserAttribute(actor, entity)) data.push(entity);
 		else total--;
 		return {
 			data,
@@ -29,29 +31,62 @@ var UserAttributeService = class extends AbstractEntityService {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.USER_UPDATE, PermissionName.USER_SELF_MANAGE] });
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new NotFoundError();
-		if (!await this.canManageUserAttribute(actor, entity)) throw new ForbiddenError();
+		if (!await this.canReadUserAttribute(actor, entity)) throw new ForbiddenError();
 		return entity;
 	}
 	async create(data, actor) {
-		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.USER_UPDATE, PermissionName.USER_SELF_MANAGE] });
+		const targetUserId = data.user_id || data.user && data.user.id;
+		const isSelfTarget = !!actor.identity && actor.identity.type === "user" && (!targetUserId || targetUserId === actor.identity.data.id);
+		let isSelfFallback = false;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });
+		} catch (e) {
+			if (!isSelfTarget) throw e;
+			isSelfFallback = true;
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });
+		}
 		await this.repository.validateJoinColumns(data);
+		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);
 		if (data.user) data.realm_id = data.user.realm_id;
 		else if (actor.identity && actor.identity.type === "user") {
 			data.user_id = actor.identity.data.id;
 			data.realm_id = actor.identity.data.realm_id;
 		} else throw new BadRequestError(buildErrorMessageForAttribute("user_id"));
 		const entity = this.repository.create(data);
-		if (!await this.canManageUserAttribute(actor, entity)) throw new ForbiddenError();
+		if (isSelfFallback) await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_SELF_MANAGE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } })
+		});
+		else await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_UPDATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
 		await this.repository.save(entity);
 		return entity;
 	}
 	async update(id, data, actor) {
-		await actor.permissionEvaluator.evaluateOneOf({ name: [PermissionName.USER_UPDATE, PermissionName.USER_SELF_MANAGE] });
 		await this.repository.validateJoinColumns(data);
+		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);
 		let entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new NotFoundError();
+		const isSelfTarget = !!actor.identity && actor.identity.type === "user" && actor.identity.data.id === entity.user_id;
+		let isSelfFallback = false;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });
+		} catch (e) {
+			if (!isSelfTarget) throw e;
+			isSelfFallback = true;
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });
+		}
 		entity = this.repository.merge(entity, data);
-		if (!await this.canManageUserAttribute(actor, entity)) throw new ForbiddenError();
+		if (isSelfFallback) await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_SELF_MANAGE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } })
+		});
+		else await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_UPDATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
 		await this.repository.save(entity);
 		return entity;
 	}
@@ -59,22 +94,14 @@ var UserAttributeService = class extends AbstractEntityService {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.USER_UPDATE, PermissionName.USER_SELF_MANAGE] });
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new NotFoundError();
-		if (!await this.canManageUserAttribute(actor, entity)) throw new ForbiddenError();
+		if (!await this.canReadUserAttribute(actor, entity)) throw new ForbiddenError();
 		const { id: entityId } = entity;
 		await this.repository.remove(entity);
 		entity.id = entityId;
 		return entity;
 	}
-	async canManageUserAttribute(actor, entity) {
-		if (actor.identity && actor.identity.type === "user" && actor.identity.data.id === entity.user_id) try {
-			await actor.permissionEvaluator.evaluate({
-				name: PermissionName.USER_SELF_MANAGE,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
-			});
-			return true;
-		} catch {
-			return false;
-		}
+	async canReadUserAttribute(actor, entity) {
+		if (actor.identity && actor.identity.type === "user" && actor.identity.data.id === entity.user_id) return true;
 		try {
 			await actor.permissionEvaluator.evaluate({
 				name: PermissionName.USER_UPDATE,

package/dist/core/entities/user-attribute/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","BadRequestError","ForbiddenError","NotFoundError","PermissionName","buildErrorMessageForAttribute","AbstractEntityService","UserAttributeService","repository","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_UPDATE","USER_SELF_MANAGE","data","entities","meta","findMany","total","entity","canManage","canManageUserAttribute","push","getOne","id","findOneBy","create","validateJoinColumns","user","realm_id","identity","type","user_id","save","update","evaluateOneOf","merge","delete","entityId","remove","isMe","evaluate","input","ATTRIBUTES"],"sources":["../../../../src/core/entities/user-attribute/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { BadRequestError, ForbiddenError, NotFoundError } from '@ebec/http';\nimport { PermissionName } from '@authup/core-kit';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { buildErrorMessageForAttribute } from 'validup';\nimport type { ActorContext } from '../actor/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IUserAttributeRepository, IUserAttributeService } from './types.ts';\n\nexport type UserAttributeServiceContext = {\n    repository: IUserAttributeRepository;\n};\n\nexport class UserAttributeService extends AbstractEntityService implements IUserAttributeService {\n    protected repository: IUserAttributeRepository;\n\n    constructor(ctx: UserAttributeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserAttribute>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n\n        const data: UserAttribute[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            const canManage = await this.canManageUserAttribute(actor, entity);\n            if (canManage) {\n                data.push(entity);\n            } else {\n                total--;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const canManage = await this.canManageUserAttribute(actor, entity);\n        if (!canManage) {\n            throw new ForbiddenError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        await this.repository.validateJoinColumns(data);\n\n        if (data.user) {\n            data.realm_id = data.user.realm_id;\n        } else if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            data.user_id = actor.identity.data.id;\n            data.realm_id = actor.identity.data.realm_id;\n        } else {\n            throw new BadRequestError(buildErrorMessageForAttribute('user_id'));\n        }\n\n        const entity = this.repository.create(data);\n\n        const canManage = await this.canManageUserAttribute(actor, entity);\n        if (!canManage) {\n            throw new ForbiddenError();\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        await this.repository.validateJoinColumns(data);\n\n        let entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        entity = this.repository.merge(entity, data);\n\n        const canManage = await this.canManageUserAttribute(actor, entity);\n        if (!canManage) {\n            throw new ForbiddenError();\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const canManage = await this.canManageUserAttribute(actor, entity);\n        if (!canManage) {\n            throw new ForbiddenError();\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    private async canManageUserAttribute(\n        actor: ActorContext,\n        entity: UserAttribute,\n    ): Promise<boolean> {\n        const isMe = actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.user_id;\n\n        if (isMe) {\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_SELF_MANAGE,\n                    input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n                });\n\n                return true;\n            } catch {\n                return false;\n            }\n        }\n\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n\n            return true;\n        } catch {\n            return false;\n        }\n    }\n}\n"],"mappings":";;;;;;AAqBA,IAAaQ,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEV,YAAYC,KAAkC;AAC1C,SAAK;AACL,OAAKD,aAAaC,IAAID;;CAG1B,MAAME,QACFC,OACAC,OACsD;AACtD,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFX,eAAeY,aACfZ,eAAea,iBAClB,EACL,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKZ,WAAWa,SAASV,MAAAA;EAEnC,MAAMO,OAAwB,EAAE;EAChC,IAAI,EAAEI,UAAUF;AAEhB,OAAK,MAAMG,UAAUJ,SAEjB,KAAIK,MADoB,KAAKC,uBAAuBb,OAAOW,OAAAA,CAEvDL,MAAKQ,KAAKH,OAAAA;MAEVD;AAIR,SAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;IACJ;GACJ;;CAGJ,MAAMK,OACFC,IACAhB,OACsB;AACtB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFX,eAAeY,aACfZ,eAAea,iBAClB,EACL,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKf,WAAWqB,UAAU,EAAED,IAAG,CAAA;AACpD,MAAI,CAACL,OACD,OAAM,IAAIpB,eAAAA;AAId,MAAI,CAACqB,MADmB,KAAKC,uBAAuBb,OAAOW,OAAAA,CAEvD,OAAM,IAAIrB,gBAAAA;AAGd,SAAOqB;;CAGX,MAAMO,OACFZ,MACAN,OACsB;AACtB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFX,eAAeY,aACfZ,eAAea,iBAClB,EACL,CAAA;AAEA,QAAM,KAAKT,WAAWuB,oBAAoBb,KAAAA;AAE1C,MAAIA,KAAKc,KACLd,MAAKe,WAAWf,KAAKc,KAAKC;WAE1BrB,MAAMsB,YACNtB,MAAMsB,SAASC,SAAS,QAC1B;AACEjB,QAAKkB,UAAUxB,MAAMsB,SAAShB,KAAKU;AACnCV,QAAKe,WAAWrB,MAAMsB,SAAShB,KAAKe;QAEpC,OAAM,IAAIhC,gBAAgBI,8BAA8B,UAAA,CAAA;EAG5D,MAAMkB,SAAS,KAAKf,WAAWsB,OAAOZ,KAAAA;AAGtC,MAAI,CAACM,MADmB,KAAKC,uBAAuBb,OAAOW,OAAAA,CAEvD,OAAM,IAAIrB,gBAAAA;AAGd,QAAM,KAAKM,WAAW6B,KAAKd,OAAAA;AAE3B,SAAOA;;CAGX,MAAMe,OACFV,IACAV,MACAN,OACsB;AACtB,QAAMA,MAAMC,oBAAoB0B,cAAc,EAC1CxB,MAAM,CACFX,eAAeY,aACfZ,eAAea,iBAClB,EACL,CAAA;AAEA,QAAM,KAAKT,WAAWuB,oBAAoBb,KAAAA;EAE1C,IAAIK,SAAS,MAAM,KAAKf,WAAWqB,UAAU,EAAED,IAAG,CAAA;AAClD,MAAI,CAACL,OACD,OAAM,IAAIpB,eAAAA;AAGdoB,WAAS,KAAKf,WAAWgC,MAAMjB,QAAQL,KAAAA;AAGvC,MAAI,CAACM,MADmB,KAAKC,uBAAuBb,OAAOW,OAAAA,CAEvD,OAAM,IAAIrB,gBAAAA;AAGd,QAAM,KAAKM,WAAW6B,KAAKd,OAAAA;AAE3B,SAAOA;;CAGX,MAAMkB,OACFb,IACAhB,OACsB;AACtB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFX,eAAeY,aACfZ,eAAea,iBAClB,EACL,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKf,WAAWqB,UAAU,EAAED,IAAG,CAAA;AACpD,MAAI,CAACL,OACD,OAAM,IAAIpB,eAAAA;AAId,MAAI,CAACqB,MADmB,KAAKC,uBAAuBb,OAAOW,OAAAA,CAEvD,OAAM,IAAIrB,gBAAAA;EAGd,MAAM,EAAE0B,IAAIc,aAAanB;AACzB,QAAM,KAAKf,WAAWmC,OAAOpB,OAAAA;AAC7BA,SAAOK,KAAKc;AAEZ,SAAOnB;;CAGX,MAAcE,uBACVb,OACAW,QACgB;AAKhB,MAJaX,MAAMsB,YACftB,MAAMsB,SAASC,SAAS,UACxBvB,MAAMsB,SAAShB,KAAKU,OAAOL,OAAOa,QAGlC,KAAI;AACA,SAAMxB,MAAMC,oBAAoBgC,SAAS;IACrC9B,MAAMX,eAAea;IACrB6B,OAAO,IAAI9C,WAAW,GAAGD,kBAAkBgD,aAAaxB,QAAO,CAAA;IACnE,CAAA;AAEA,UAAO;UACH;AACJ,UAAO;;AAIf,MAAI;AACA,SAAMX,MAAMC,oBAAoBgC,SAAS;IACrC9B,MAAMX,eAAeY;IACrB8B,OAAO,IAAI9C,WAAW,GAAGD,kBAAkBgD,aAAaxB,QAAO,CAAA;IACnE,CAAA;AAEA,UAAO;UACH;AACJ,UAAO"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","BadRequestError","ForbiddenError","NotFoundError","PermissionName","buildErrorMessageForAttribute","AbstractEntityService","UserAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_UPDATE","USER_SELF_MANAGE","data","entities","meta","findMany","total","entity","canRead","canReadUserAttribute","push","getOne","id","findOneBy","create","targetUserId","user_id","user","isSelfTarget","identity","type","isSelfFallback","preEvaluate","e","validateJoinColumns","has","realm_id","evaluate","input","ATTRIBUTES","value","save","update","merge","delete","entityId","remove","isMe"],"sources":["../../../../src/core/entities/user-attribute/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { BadRequestError, ForbiddenError, NotFoundError } from '@ebec/http';\nimport { PermissionName } from '@authup/core-kit';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { buildErrorMessageForAttribute } from 'validup';\nimport type { ActorContext } from '../actor/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IUserAttributeRepository, IUserAttributeService } from './types.ts';\n\nexport type UserAttributeServiceContext = {\n    repository: IUserAttributeRepository;\n    reservedNames?: ReadonlySet<string>;\n};\n\nexport class UserAttributeService extends AbstractEntityService implements IUserAttributeService {\n    protected repository: IUserAttributeRepository;\n\n    protected reservedNames: ReadonlySet<string>;\n\n    constructor(ctx: UserAttributeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.reservedNames = ctx.reservedNames ?? new Set();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserAttribute>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(query);\n\n        const data: UserAttribute[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            const canRead = await this.canReadUserAttribute(actor, entity);\n            if (canRead) {\n                data.push(entity);\n            } else {\n                total--;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new ForbiddenError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        const targetUserId: string | undefined = data.user_id ||\n            (data.user && data.user.id);\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            (!targetUserId || targetUserId === actor.identity.data.id);\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        if (data.user) {\n            data.realm_id = data.user.realm_id;\n        } else if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            data.user_id = actor.identity.data.id;\n            data.realm_id = actor.identity.data.realm_id;\n        } else {\n            throw new BadRequestError(buildErrorMessageForAttribute('user_id'));\n        }\n\n        const entity = this.repository.create(data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        let entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.user_id;\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        entity = this.repository.merge(entity, data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new ForbiddenError();\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    private async canReadUserAttribute(\n        actor: ActorContext,\n        entity: UserAttribute,\n    ): Promise<boolean> {\n        const isMe = actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.user_id;\n\n        if (isMe) {\n            return true;\n        }\n\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n\n            return true;\n        } catch {\n            return false;\n        }\n    }\n}\n"],"mappings":";;;;;;AAsBA,IAAaQ,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YAAYC,KAAkC;AAC1C,SAAK;AACL,OAAKF,aAAaE,IAAIF;AACtB,OAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,KAAAA;;CAGlD,MAAMC,QACFC,OACAC,OACsD;AACtD,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,iBAClB,EACL,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKd,WAAWe,SAASV,MAAAA;EAEnC,MAAMO,OAAwB,EAAE;EAChC,IAAI,EAAEI,UAAUF;AAEhB,OAAK,MAAMG,UAAUJ,SAEjB,KAAIK,MADkB,KAAKC,qBAAqBb,OAAOW,OAAAA,CAEnDL,MAAKQ,KAAKH,OAAAA;MAEVD;AAIR,SAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;IACJ;GACJ;;CAGJ,MAAMK,OACFC,IACAhB,OACsB;AACtB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,iBAClB,EACL,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,IAAG,CAAA;AACpD,MAAI,CAACL,OACD,OAAM,IAAItB,eAAAA;AAId,MAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,OAAAA,CAEnD,OAAM,IAAIvB,gBAAAA;AAGd,SAAOuB;;CAGX,MAAMO,OACFZ,MACAN,OACsB;EACtB,MAAMmB,eAAmCb,KAAKc,WACzCd,KAAKe,QAAQf,KAAKe,KAAKL;EAE5B,MAAMM,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,WACvB,CAACL,gBAAgBA,iBAAiBnB,MAAMuB,SAASjB,KAAKU;EAE3D,IAAIS,iBAAiB;AACrB,MAAI;AACA,SAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,aAAY,CAAA;WAC1EuB,GAAG;AACR,OAAI,CAACL,aACD,OAAMK;AAEVF,oBAAiB;AACjB,SAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,kBAAiB,CAAA;;AAGxF,QAAM,KAAKX,WAAWkC,oBAAoBtB,KAAAA;AAE1C,MAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,KAAI,CACjE,OAAM,IAAIhB,gBAAgB,4BAA4BmB,KAAKH,KAAK,uCAAsC;AAG1G,MAAIG,KAAKe,KACLf,MAAKwB,WAAWxB,KAAKe,KAAKS;WAE1B9B,MAAMuB,YACNvB,MAAMuB,SAASC,SAAS,QAC1B;AACElB,QAAKc,UAAUpB,MAAMuB,SAASjB,KAAKU;AACnCV,QAAKwB,WAAW9B,MAAMuB,SAASjB,KAAKwB;QAEpC,OAAM,IAAI3C,gBAAgBI,8BAA8B,UAAA,CAAA;EAG5D,MAAMoB,SAAS,KAAKjB,WAAWwB,OAAOZ,KAAAA;AAEtC,MAAImB,eACA,OAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrB2B,OAAO,IAAI9C,WAAW,GAAGD,kBAAkBgD,aAAa,GAAG3B,KAAKH,OAAOG,KAAK4B,OAAM,EAAE,CAAA;GACxF,CAAA;MAEA,OAAMlC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrB4B,OAAO,IAAI9C,WAAW,GAAGD,kBAAkBgD,aAAatB,QAAO,CAAA;GACnE,CAAA;AAGJ,QAAM,KAAKjB,WAAWyC,KAAKxB,OAAAA;AAE3B,SAAOA;;CAGX,MAAMyB,OACFpB,IACAV,MACAN,OACsB;AACtB,QAAM,KAAKN,WAAWkC,oBAAoBtB,KAAAA;AAE1C,MAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,KAAI,CACjE,OAAM,IAAIhB,gBAAgB,4BAA4BmB,KAAKH,KAAK,uCAAsC;EAG1G,IAAIQ,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,IAAG,CAAA;AAClD,MAAI,CAACL,OACD,OAAM,IAAItB,eAAAA;EAGd,MAAMiC,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS;EAEtC,IAAIK,iBAAiB;AACrB,MAAI;AACA,SAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,aAAY,CAAA;WAC1EuB,GAAG;AACR,OAAI,CAACL,aACD,OAAMK;AAEVF,oBAAiB;AACjB,SAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,kBAAiB,CAAA;;AAGxFM,WAAS,KAAKjB,WAAW2C,MAAM1B,QAAQL,KAAAA;AAEvC,MAAImB,eACA,OAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrB2B,OAAO,IAAI9C,WAAW,GAAGD,kBAAkBgD,aAAa,GAAGtB,OAAOR,OAAOQ,OAAOuB,OAAM,EAAE,CAAA;GAC5F,CAAA;MAEA,OAAMlC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrB4B,OAAO,IAAI9C,WAAW,GAAGD,kBAAkBgD,aAAatB,QAAO,CAAA;GACnE,CAAA;AAGJ,QAAM,KAAKjB,WAAWyC,KAAKxB,OAAAA;AAE3B,SAAOA;;CAGX,MAAM2B,OACFtB,IACAhB,OACsB;AACtB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,iBAClB,EACL,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,IAAG,CAAA;AACpD,MAAI,CAACL,OACD,OAAM,IAAItB,eAAAA;AAId,MAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,OAAAA,CAEnD,OAAM,IAAIvB,gBAAAA;EAGd,MAAM,EAAE4B,IAAIuB,aAAa5B;AACzB,QAAM,KAAKjB,WAAW8C,OAAO7B,OAAAA;AAC7BA,SAAOK,KAAKuB;AAEZ,SAAO5B;;CAGX,MAAcE,qBACVb,OACAW,QACgB;AAKhB,MAJaX,MAAMuB,YACfvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS,QAGlC,QAAO;AAGX,MAAI;AACA,SAAMpB,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAMb,eAAec;IACrB4B,OAAO,IAAI9C,WAAW,GAAGD,kBAAkBgD,aAAatB,QAAO,CAAA;IACnE,CAAA;AAEA,UAAO;UACH;AACJ,UAAO"}

package/dist/core/identity/index.d.ts

@@ -4,4 +4,5 @@ export * from './permission/index.ts';
 export * from './provider/index.ts';
 export * from './registration/index.ts';
 export * from './resolver/index.ts';
+export * from './role/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/identity/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/identity/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC"}

package/dist/core/identity/index.mjs

@@ -24,4 +24,5 @@ import { RegistrationService } from "./registration/service.mjs";
 import "./registration/index.mjs";
 import { IdentityResolver } from "./resolver/module.mjs";
 import "./resolver/index.mjs";
-export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityResolver, PasswordRecoveryService, RegistrationService, createIdentityProviderOAuth2Authenticator };
+import { IdentityRoleProvider } from "./role/module.mjs";
+export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityResolver, IdentityRoleProvider, PasswordRecoveryService, RegistrationService, createIdentityProviderOAuth2Authenticator };

package/dist/core/identity/permission/module.d.ts

@@ -1,11 +1,17 @@
 import type { IdentityPolicyData, PermissionPolicyBinding } from '@authup/access';
 import type { Policy } from '@authup/core-kit';
-import type { IIdentityBindingRepository, IIdentityPermissionProvider, IRoleBindingRepository, IdentityPermissionProviderContext, ResolveJunctionPolicyOptions } from './types.ts';
+import type { IClientRepository } from '../../entities/client/types.ts';
+import type { IRobotRepository } from '../../entities/robot/types.ts';
+import type { IRoleRepository } from '../../entities/role/types.ts';
+import type { IUserRepository } from '../../entities/user/types.ts';
+import type { IIdentityRoleProvider } from '../role/types.ts';
+import type { IIdentityPermissionProvider, IdentityPermissionProviderContext, ResolveJunctionPolicyOptions } from './types.ts';
 export declare class IdentityPermissionProvider implements IIdentityPermissionProvider {
-    protected clientRepository: IIdentityBindingRepository;
-    protected userRepository: IIdentityBindingRepository;
-    protected roleRepository: IRoleBindingRepository;
-    protected robotRepository: IIdentityBindingRepository;
+    protected clientRepository: IClientRepository;
+    protected userRepository: IUserRepository;
+    protected roleRepository: IRoleRepository;
+    protected robotRepository: IRobotRepository;
+    protected roleProvider: IIdentityRoleProvider;
     constructor(ctx: IdentityPermissionProviderContext);
     isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData): Promise<boolean>;
     resolveJunctionPolicy(identity: IdentityPolicyData, options: ResolveJunctionPolicyOptions): Promise<Policy | undefined>;
@@ -14,7 +20,7 @@ export declare class IdentityPermissionProvider implements IIdentityPermissionPr
     getForUser(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
     getForRobot(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
     getForRole(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
+    private combineWithRoleBindings;
     private reduceBindingsByIdentityClient;
-    private reduceEntitiesByIdentityClient;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/identity/permission/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,kBAAkB,EAClB,uBAAuB,EAC1B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EACR,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,iCAAiC,EACjC,4BAA4B,EAC/B,MAAM,YAAY,CAAC;AAEpB,qBAAa,0BAA2B,YAAW,2BAA2B;IAC1E,SAAS,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;IAEvD,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC;IAErD,SAAS,CAAC,cAAc,EAAE,sBAAsB,CAAC;IAEjD,SAAS,CAAC,eAAe,EAAE,0BAA0B,CAAC;gBAE1C,GAAG,EAAE,iCAAiC;IAO5C,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,OAAO,CAAC;IA2BpF,qBAAqB,CACvB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,4BAA4B,GACtC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAsCxB,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAmBzE,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAc/E,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAkB7E,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAkB9E,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAKnF,OAAO,CAAC,8BAA8B;IAWtC,OAAO,CAAC,8BAA8B;CAUzC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,kBAAkB,EAClB,uBAAuB,EAC1B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EACR,2BAA2B,EAC3B,iCAAiC,EACjC,4BAA4B,EAC/B,MAAM,YAAY,CAAC;AAEpB,qBAAa,0BAA2B,YAAW,2BAA2B;IAC1E,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,YAAY,EAAE,qBAAqB,CAAC;gBAElC,GAAG,EAAE,iCAAiC;IAQ5C,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,OAAO,CAAC;IA2BpF,qBAAqB,CACvB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,4BAA4B,GACtC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAsCxB,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAmBzE,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAO/E,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ7E,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ9E,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YAKrE,uBAAuB;IAmBrC,OAAO,CAAC,8BAA8B;CAUzC"}

package/dist/core/identity/permission/module.mjs

@@ -6,11 +6,13 @@ var IdentityPermissionProvider = class {
 	userRepository;
 	roleRepository;
 	robotRepository;
+	roleProvider;
 	constructor(ctx) {
 		this.clientRepository = ctx.clientRepository;
 		this.userRepository = ctx.userRepository;
 		this.roleRepository = ctx.roleRepository;
 		this.robotRepository = ctx.robotRepository;
+		this.roleProvider = ctx.roleProvider;
 	}
 	async isSuperset(parent, child) {
 		const parentBindings = await this.getFor(parent);
@@ -52,37 +54,27 @@ var IdentityPermissionProvider = class {
 		return [];
 	}
 	async getForClient(identity) {
-		const bindings = await this.clientRepository.getBoundPermissions(identity.id);
-		const roles = await this.clientRepository.getBoundRoles(identity.id);
-		const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);
-		if (roleBindings.length === 0) return bindings;
-		return [...bindings, ...roleBindings];
+		return this.combineWithRoleBindings(this.clientRepository.getBoundPermissions(identity.id), identity);
 	}
 	async getForUser(identity) {
-		const bindings = await this.userRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity));
-		const roles = await this.userRepository.getBoundRoles(identity.id).then((data) => this.reduceEntitiesByIdentityClient(data, identity));
-		const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);
-		if (roleBindings.length === 0) return bindings;
-		return [...bindings, ...roleBindings];
+		return this.combineWithRoleBindings(this.userRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity)), identity);
 	}
 	async getForRobot(identity) {
-		const bindings = await this.robotRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity));
-		const roles = await this.robotRepository.getBoundRoles(identity.id).then((data) => this.reduceEntitiesByIdentityClient(data, identity));
-		const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);
-		if (roleBindings.length === 0) return bindings;
-		return [...bindings, ...roleBindings];
+		return this.combineWithRoleBindings(this.robotRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity)), identity);
 	}
 	async getForRole(identity) {
 		return this.roleRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity));
 	}
+	async combineWithRoleBindings(bindingsPromise, identity) {
+		const [bindings, roles] = await Promise.all([bindingsPromise, this.roleProvider.getRolesFor(identity)]);
+		const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);
+		if (roleBindings.length === 0) return bindings;
+		return [...bindings, ...roleBindings];
+	}
 	reduceBindingsByIdentityClient(bindings, identity) {
 		if (!identity.clientId) return bindings;
 		return bindings.filter((binding) => binding.permission.client_id === identity.clientId);
 	}
-	reduceEntitiesByIdentityClient(entities, identity) {
-		if (!identity.clientId) return entities;
-		return entities.filter((entity) => entity.client_id === identity.clientId);
-	}
 };
 //#endregion
 export { IdentityPermissionProvider };

package/dist/core/identity/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["isPermissionPolicyBindingEqual","mergePermissionPolicyBindings","isPolicy","IdentityPermissionProvider","clientRepository","userRepository","roleRepository","robotRepository","ctx","isSuperset","parent","child","parentBindings","getFor","childBindings","parentMerged","childMerged","childItem","parentItem","find","p","policies","length","resolveJunctionPolicy","identity","options","bindings","matching","filter","b","permission","name","realmId","realm_id","clientId","client_id","undefined","merged","policy","type","getForClient","getForUser","getForRobot","getForRole","getBoundPermissions","id","roles","getBoundRoles","roleBindings","getBoundPermissionsForMany","then","data","reduceBindingsByIdentityClient","reduceEntitiesByIdentityClient","binding","entities","entity"],"sources":["../../../../src/core/identity/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    IdentityPolicyData,\n    PermissionPolicyBinding,\n} from '@authup/access';\nimport { isPermissionPolicyBindingEqual, mergePermissionPolicyBindings } from '@authup/access';\nimport type { Policy } from '@authup/core-kit';\nimport { isPolicy } from '@authup/core-kit';\nimport type {\n    IIdentityBindingRepository,\n    IIdentityPermissionProvider,\n    IRoleBindingRepository,\n    IdentityPermissionProviderContext,\n    ResolveJunctionPolicyOptions,\n} from './types.ts';\n\nexport class IdentityPermissionProvider implements IIdentityPermissionProvider {\n    protected clientRepository: IIdentityBindingRepository;\n\n    protected userRepository: IIdentityBindingRepository;\n\n    protected roleRepository: IRoleBindingRepository;\n\n    protected robotRepository: IIdentityBindingRepository;\n\n    constructor(ctx: IdentityPermissionProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData) : Promise<boolean> {\n        const parentBindings = await this.getFor(parent);\n        const childBindings = await this.getFor(child);\n\n        const parentMerged = mergePermissionPolicyBindings(parentBindings);\n        const childMerged = mergePermissionPolicyBindings(childBindings);\n\n        for (const childItem of childMerged) {\n            const parentItem = parentMerged.find(\n                (p) => isPermissionPolicyBindingEqual(p, childItem),\n            );\n\n            if (!parentItem) {\n                return false;\n            }\n\n            if (\n                parentItem.policies && parentItem.policies.length > 0 &&\n                (!childItem.policies || childItem.policies.length === 0)\n            ) {\n                return false;\n            }\n        }\n\n        return true;\n    }\n\n    async resolveJunctionPolicy(\n        identity: IdentityPolicyData,\n        options: ResolveJunctionPolicyOptions,\n    ): Promise<Policy | undefined> {\n        const bindings = await this.getFor(identity);\n        const matching = bindings.filter((b) => {\n            if (b.permission.name !== options.name) {\n                return false;\n            }\n\n            if (typeof options.realmId !== 'undefined') {\n                if ((b.permission.realm_id ?? null) !== (options.realmId ?? null)) {\n                    return false;\n                }\n            }\n\n            if (typeof options.clientId !== 'undefined') {\n                if ((b.permission.client_id ?? null) !== (options.clientId ?? null)) {\n                    return false;\n                }\n            }\n\n            return true;\n        });\n\n        if (matching.length === 0) {\n            return undefined;\n        }\n\n        const merged = mergePermissionPolicyBindings(matching);\n\n        if (merged.length > 0 && merged[0].policies && merged[0].policies.length > 0) {\n            const policy = merged[0].policies[0];\n            if (isPolicy(policy)) {\n                return policy;\n            }\n        }\n\n        return undefined;\n    }\n\n    async getFor(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.getForClient(identity);\n            }\n            case 'user': {\n                return this.getForUser(identity);\n            }\n            case 'robot': {\n                return this.getForRobot(identity);\n            }\n            case 'role': {\n                return this.getForRole(identity);\n            }\n        }\n\n        return [];\n    }\n\n    async getForClient(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        const bindings = await this.clientRepository.getBoundPermissions(identity.id);\n        const roles = await this.clientRepository.getBoundRoles(identity.id);\n        const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);\n        if (roleBindings.length === 0) {\n            return bindings;\n        }\n\n        return [\n            ...bindings,\n            ...roleBindings,\n        ];\n    }\n\n    async getForUser(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        const bindings = await this.userRepository.getBoundPermissions(identity.id)\n            .then((data) => this.reduceBindingsByIdentityClient(data, identity));\n\n        const roles = await this.userRepository.getBoundRoles(identity.id)\n            .then((data) => this.reduceEntitiesByIdentityClient(data, identity));\n\n        const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);\n        if (roleBindings.length === 0) {\n            return bindings;\n        }\n\n        return [\n            ...bindings,\n            ...roleBindings,\n        ];\n    }\n\n    async getForRobot(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        const bindings = await this.robotRepository.getBoundPermissions(identity.id)\n            .then((data) => this.reduceBindingsByIdentityClient(data, identity));\n\n        const roles = await this.robotRepository.getBoundRoles(identity.id)\n            .then((data) => this.reduceEntitiesByIdentityClient(data, identity));\n\n        const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);\n        if (roleBindings.length === 0) {\n            return bindings;\n        }\n\n        return [\n            ...bindings,\n            ...roleBindings,\n        ];\n    }\n\n    async getForRole(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.roleRepository.getBoundPermissions(identity.id)\n            .then((data) => this.reduceBindingsByIdentityClient(data, identity));\n    }\n\n    private reduceBindingsByIdentityClient(\n        bindings: PermissionPolicyBinding[],\n        identity: IdentityPolicyData,\n    ): PermissionPolicyBinding[] {\n        if (!identity.clientId) {\n            return bindings;\n        }\n\n        return bindings.filter((binding) => binding.permission.client_id === identity.clientId);\n    }\n\n    private reduceEntitiesByIdentityClient<T extends { client_id?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        return entities.filter((entity) => entity.client_id === identity.clientId);\n    }\n}\n"],"mappings":";;;AAsBA,IAAaG,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;AAChD,OAAKJ,mBAAmBI,IAAIJ;AAC5B,OAAKC,iBAAiBG,IAAIH;AAC1B,OAAKC,iBAAiBE,IAAIF;AAC1B,OAAKC,kBAAkBC,IAAID;;CAG/B,MAAME,WAAWC,QAA4BC,OAA8C;EACvF,MAAMC,iBAAiB,MAAM,KAAKC,OAAOH,OAAAA;EACzC,MAAMI,gBAAgB,MAAM,KAAKD,OAAOF,MAAAA;EAExC,MAAMI,eAAed,8BAA8BW,eAAAA;EACnD,MAAMI,cAAcf,8BAA8Ba,cAAAA;AAElD,OAAK,MAAMG,aAAaD,aAAa;GACjC,MAAME,aAAaH,aAAaI,MAC3BC,MAAMpB,+BAA+BoB,GAAGH,UAAAA,CAAAA;AAG7C,OAAI,CAACC,WACD,QAAO;AAGX,OACIA,WAAWG,YAAYH,WAAWG,SAASC,SAAS,MACnD,CAACL,UAAUI,YAAYJ,UAAUI,SAASC,WAAW,GAEtD,QAAO;;AAIf,SAAO;;CAGX,MAAMC,sBACFC,UACAC,SAC2B;EAE3B,MAAME,YAAWD,MADM,KAAKb,OAAOW,SAAAA,EACTI,QAAQC,MAAAA;AAC9B,OAAIA,EAAEC,WAAWC,SAASN,QAAQM,KAC9B,QAAO;AAGX,OAAI,OAAON,QAAQO,YAAY;SACtBH,EAAEC,WAAWG,YAAY,WAAWR,QAAQO,WAAW,MACxD,QAAO;;AAIf,OAAI,OAAOP,QAAQS,aAAa;SACvBL,EAAEC,WAAWK,aAAa,WAAWV,QAAQS,YAAY,MAC1D,QAAO;;AAIf,UAAO;IACX;AAEA,MAAIP,SAASL,WAAW,EACpB;EAGJ,MAAMe,SAASpC,8BAA8B0B,SAAAA;AAE7C,MAAIU,OAAOf,SAAS,KAAKe,OAAO,GAAGhB,YAAYgB,OAAO,GAAGhB,SAASC,SAAS,GAAG;GAC1E,MAAMgB,SAASD,OAAO,GAAGhB,SAAS;AAClC,OAAInB,SAASoC,OAAAA,CACT,QAAOA;;;CAOnB,MAAMzB,OAAOW,UAAmE;AAC5E,UAAQA,SAASe,MAAjB;GACI,KAAK,SACD,QAAO,KAAKC,aAAahB,SAAAA;GAE7B,KAAK,OACD,QAAO,KAAKiB,WAAWjB,SAAAA;GAE3B,KAAK,QACD,QAAO,KAAKkB,YAAYlB,SAAAA;GAE5B,KAAK,OACD,QAAO,KAAKmB,WAAWnB,SAAAA;;AAI/B,SAAO,EAAE;;CAGb,MAAMgB,aAAahB,UAAmE;EAClF,MAAME,WAAW,MAAM,KAAKtB,iBAAiBwC,oBAAoBpB,SAASqB,GAAE;EAC5E,MAAMC,QAAQ,MAAM,KAAK1C,iBAAiB2C,cAAcvB,SAASqB,GAAE;EACnE,MAAMG,eAAe,MAAM,KAAK1C,eAAe2C,2BAA2BH,MAAAA;AAC1E,MAAIE,aAAa1B,WAAW,EACxB,QAAOI;AAGX,SAAO,CAAA,GACAA,UAAAA,GACAsB,aACN;;CAGL,MAAMP,WAAWjB,UAAmE;EAChF,MAAME,WAAW,MAAM,KAAKrB,eAAeuC,oBAAoBpB,SAASqB,GAAE,CACrEK,MAAMC,SAAS,KAAKC,+BAA+BD,MAAM3B,SAAAA,CAAAA;EAE9D,MAAMsB,QAAQ,MAAM,KAAKzC,eAAe0C,cAAcvB,SAASqB,GAAE,CAC5DK,MAAMC,SAAS,KAAKE,+BAA+BF,MAAM3B,SAAAA,CAAAA;EAE9D,MAAMwB,eAAe,MAAM,KAAK1C,eAAe2C,2BAA2BH,MAAAA;AAC1E,MAAIE,aAAa1B,WAAW,EACxB,QAAOI;AAGX,SAAO,CAAA,GACAA,UAAAA,GACAsB,aACN;;CAGL,MAAMN,YAAYlB,UAAmE;EACjF,MAAME,WAAW,MAAM,KAAKnB,gBAAgBqC,oBAAoBpB,SAASqB,GAAE,CACtEK,MAAMC,SAAS,KAAKC,+BAA+BD,MAAM3B,SAAAA,CAAAA;EAE9D,MAAMsB,QAAQ,MAAM,KAAKvC,gBAAgBwC,cAAcvB,SAASqB,GAAE,CAC7DK,MAAMC,SAAS,KAAKE,+BAA+BF,MAAM3B,SAAAA,CAAAA;EAE9D,MAAMwB,eAAe,MAAM,KAAK1C,eAAe2C,2BAA2BH,MAAAA;AAC1E,MAAIE,aAAa1B,WAAW,EACxB,QAAOI;AAGX,SAAO,CAAA,GACAA,UAAAA,GACAsB,aACN;;CAGL,MAAML,WAAWnB,UAAmE;AAChF,SAAO,KAAKlB,eAAesC,oBAAoBpB,SAASqB,GAAE,CACrDK,MAAMC,SAAS,KAAKC,+BAA+BD,MAAM3B,SAAAA,CAAAA;;CAG1D4B,+BACJ1B,UACAF,UACyB;AACzB,MAAI,CAACA,SAASU,SACV,QAAOR;AAGX,SAAOA,SAASE,QAAQ0B,YAAYA,QAAQxB,WAAWK,cAAcX,SAASU,SAAQ;;CAGlFmB,+BACJE,UACA/B,UACG;AACH,MAAI,CAACA,SAASU,SACV,QAAOqB;AAGX,SAAOA,SAAS3B,QAAQ4B,WAAWA,OAAOrB,cAAcX,SAASU,SAAQ"}
+{"version":3,"file":"module.mjs","names":["isPermissionPolicyBindingEqual","mergePermissionPolicyBindings","isPolicy","IdentityPermissionProvider","clientRepository","userRepository","roleRepository","robotRepository","roleProvider","ctx","isSuperset","parent","child","parentBindings","getFor","childBindings","parentMerged","childMerged","childItem","parentItem","find","p","policies","length","resolveJunctionPolicy","identity","options","bindings","matching","filter","b","permission","name","realmId","realm_id","clientId","client_id","undefined","merged","policy","type","getForClient","getForUser","getForRobot","getForRole","combineWithRoleBindings","getBoundPermissions","id","then","data","reduceBindingsByIdentityClient","bindingsPromise","roles","Promise","all","getRolesFor","roleBindings","getBoundPermissionsForMany","binding"],"sources":["../../../../src/core/identity/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    IdentityPolicyData,\n    PermissionPolicyBinding,\n} from '@authup/access';\nimport { isPermissionPolicyBindingEqual, mergePermissionPolicyBindings } from '@authup/access';\nimport type { Policy } from '@authup/core-kit';\nimport { isPolicy } from '@authup/core-kit';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IRoleRepository } from '../../entities/role/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider } from '../role/types.ts';\nimport type {\n    IIdentityPermissionProvider,\n    IdentityPermissionProviderContext,\n    ResolveJunctionPolicyOptions,\n} from './types.ts';\n\nexport class IdentityPermissionProvider implements IIdentityPermissionProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    protected roleProvider: IIdentityRoleProvider;\n\n    constructor(ctx: IdentityPermissionProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.robotRepository = ctx.robotRepository;\n        this.roleProvider = ctx.roleProvider;\n    }\n\n    async isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData) : Promise<boolean> {\n        const parentBindings = await this.getFor(parent);\n        const childBindings = await this.getFor(child);\n\n        const parentMerged = mergePermissionPolicyBindings(parentBindings);\n        const childMerged = mergePermissionPolicyBindings(childBindings);\n\n        for (const childItem of childMerged) {\n            const parentItem = parentMerged.find(\n                (p) => isPermissionPolicyBindingEqual(p, childItem),\n            );\n\n            if (!parentItem) {\n                return false;\n            }\n\n            if (\n                parentItem.policies && parentItem.policies.length > 0 &&\n                (!childItem.policies || childItem.policies.length === 0)\n            ) {\n                return false;\n            }\n        }\n\n        return true;\n    }\n\n    async resolveJunctionPolicy(\n        identity: IdentityPolicyData,\n        options: ResolveJunctionPolicyOptions,\n    ): Promise<Policy | undefined> {\n        const bindings = await this.getFor(identity);\n        const matching = bindings.filter((b) => {\n            if (b.permission.name !== options.name) {\n                return false;\n            }\n\n            if (typeof options.realmId !== 'undefined') {\n                if ((b.permission.realm_id ?? null) !== (options.realmId ?? null)) {\n                    return false;\n                }\n            }\n\n            if (typeof options.clientId !== 'undefined') {\n                if ((b.permission.client_id ?? null) !== (options.clientId ?? null)) {\n                    return false;\n                }\n            }\n\n            return true;\n        });\n\n        if (matching.length === 0) {\n            return undefined;\n        }\n\n        const merged = mergePermissionPolicyBindings(matching);\n\n        if (merged.length > 0 && merged[0].policies && merged[0].policies.length > 0) {\n            const policy = merged[0].policies[0];\n            if (isPolicy(policy)) {\n                return policy;\n            }\n        }\n\n        return undefined;\n    }\n\n    async getFor(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.getForClient(identity);\n            }\n            case 'user': {\n                return this.getForUser(identity);\n            }\n            case 'robot': {\n                return this.getForRobot(identity);\n            }\n            case 'role': {\n                return this.getForRole(identity);\n            }\n        }\n\n        return [];\n    }\n\n    async getForClient(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.combineWithRoleBindings(\n            this.clientRepository.getBoundPermissions(identity.id),\n            identity,\n        );\n    }\n\n    async getForUser(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.combineWithRoleBindings(\n            this.userRepository.getBoundPermissions(identity.id)\n                .then((data) => this.reduceBindingsByIdentityClient(data, identity)),\n            identity,\n        );\n    }\n\n    async getForRobot(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.combineWithRoleBindings(\n            this.robotRepository.getBoundPermissions(identity.id)\n                .then((data) => this.reduceBindingsByIdentityClient(data, identity)),\n            identity,\n        );\n    }\n\n    async getForRole(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.roleRepository.getBoundPermissions(identity.id)\n            .then((data) => this.reduceBindingsByIdentityClient(data, identity));\n    }\n\n    private async combineWithRoleBindings(\n        bindingsPromise: Promise<PermissionPolicyBinding[]>,\n        identity: IdentityPolicyData,\n    ): Promise<PermissionPolicyBinding[]> {\n        const [bindings, roles] = await Promise.all([\n            bindingsPromise,\n            this.roleProvider.getRolesFor(identity),\n        ]);\n        const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);\n        if (roleBindings.length === 0) {\n            return bindings;\n        }\n\n        return [\n            ...bindings,\n            ...roleBindings,\n        ];\n    }\n\n    private reduceBindingsByIdentityClient(\n        bindings: PermissionPolicyBinding[],\n        identity: IdentityPolicyData,\n    ): PermissionPolicyBinding[] {\n        if (!identity.clientId) {\n            return bindings;\n        }\n\n        return bindings.filter((binding) => binding.permission.client_id === identity.clientId);\n    }\n}\n"],"mappings":";;;AAyBA,IAAaG,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;AAChD,OAAKL,mBAAmBK,IAAIL;AAC5B,OAAKC,iBAAiBI,IAAIJ;AAC1B,OAAKC,iBAAiBG,IAAIH;AAC1B,OAAKC,kBAAkBE,IAAIF;AAC3B,OAAKC,eAAeC,IAAID;;CAG5B,MAAME,WAAWC,QAA4BC,OAA8C;EACvF,MAAMC,iBAAiB,MAAM,KAAKC,OAAOH,OAAAA;EACzC,MAAMI,gBAAgB,MAAM,KAAKD,OAAOF,MAAAA;EAExC,MAAMI,eAAef,8BAA8BY,eAAAA;EACnD,MAAMI,cAAchB,8BAA8Bc,cAAAA;AAElD,OAAK,MAAMG,aAAaD,aAAa;GACjC,MAAME,aAAaH,aAAaI,MAC3BC,MAAMrB,+BAA+BqB,GAAGH,UAAAA,CAAAA;AAG7C,OAAI,CAACC,WACD,QAAO;AAGX,OACIA,WAAWG,YAAYH,WAAWG,SAASC,SAAS,MACnD,CAACL,UAAUI,YAAYJ,UAAUI,SAASC,WAAW,GAEtD,QAAO;;AAIf,SAAO;;CAGX,MAAMC,sBACFC,UACAC,SAC2B;EAE3B,MAAME,YAAWD,MADM,KAAKb,OAAOW,SAAAA,EACTI,QAAQC,MAAAA;AAC9B,OAAIA,EAAEC,WAAWC,SAASN,QAAQM,KAC9B,QAAO;AAGX,OAAI,OAAON,QAAQO,YAAY;SACtBH,EAAEC,WAAWG,YAAY,WAAWR,QAAQO,WAAW,MACxD,QAAO;;AAIf,OAAI,OAAOP,QAAQS,aAAa;SACvBL,EAAEC,WAAWK,aAAa,WAAWV,QAAQS,YAAY,MAC1D,QAAO;;AAIf,UAAO;IACX;AAEA,MAAIP,SAASL,WAAW,EACpB;EAGJ,MAAMe,SAASrC,8BAA8B2B,SAAAA;AAE7C,MAAIU,OAAOf,SAAS,KAAKe,OAAO,GAAGhB,YAAYgB,OAAO,GAAGhB,SAASC,SAAS,GAAG;GAC1E,MAAMgB,SAASD,OAAO,GAAGhB,SAAS;AAClC,OAAIpB,SAASqC,OAAAA,CACT,QAAOA;;;CAOnB,MAAMzB,OAAOW,UAAmE;AAC5E,UAAQA,SAASe,MAAjB;GACI,KAAK,SACD,QAAO,KAAKC,aAAahB,SAAAA;GAE7B,KAAK,OACD,QAAO,KAAKiB,WAAWjB,SAAAA;GAE3B,KAAK,QACD,QAAO,KAAKkB,YAAYlB,SAAAA;GAE5B,KAAK,OACD,QAAO,KAAKmB,WAAWnB,SAAAA;;AAI/B,SAAO,EAAE;;CAGb,MAAMgB,aAAahB,UAAmE;AAClF,SAAO,KAAKoB,wBACR,KAAKzC,iBAAiB0C,oBAAoBrB,SAASsB,GAAE,EACrDtB,SAAAA;;CAIR,MAAMiB,WAAWjB,UAAmE;AAChF,SAAO,KAAKoB,wBACR,KAAKxC,eAAeyC,oBAAoBrB,SAASsB,GAAE,CAC9CC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAMxB,SAAAA,CAAAA,EAC9DA,SAAAA;;CAIR,MAAMkB,YAAYlB,UAAmE;AACjF,SAAO,KAAKoB,wBACR,KAAKtC,gBAAgBuC,oBAAoBrB,SAASsB,GAAE,CAC/CC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAMxB,SAAAA,CAAAA,EAC9DA,SAAAA;;CAIR,MAAMmB,WAAWnB,UAAmE;AAChF,SAAO,KAAKnB,eAAewC,oBAAoBrB,SAASsB,GAAE,CACrDC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAMxB,SAAAA,CAAAA;;CAGlE,MAAcoB,wBACVM,iBACA1B,UACkC;EAClC,MAAM,CAACE,UAAUyB,SAAS,MAAMC,QAAQC,IAAI,CACxCH,iBACA,KAAK3C,aAAa+C,YAAY9B,SAAAA,CACjC,CAAA;EACD,MAAM+B,eAAe,MAAM,KAAKlD,eAAemD,2BAA2BL,MAAAA;AAC1E,MAAII,aAAajC,WAAW,EACxB,QAAOI;AAGX,SAAO,CAAA,GACAA,UAAAA,GACA6B,aACN;;CAGGN,+BACJvB,UACAF,UACyB;AACzB,MAAI,CAACA,SAASU,SACV,QAAOR;AAGX,SAAOA,SAASE,QAAQ6B,YAAYA,QAAQ3B,WAAWK,cAAcX,SAASU,SAAQ"}

package/dist/core/identity/permission/types.d.ts

@@ -1,5 +1,10 @@
-import type { Policy, Role } from '@authup/core-kit';
+import type { Policy } from '@authup/core-kit';
 import type { IdentityPolicyData, PermissionPolicyBinding } from '@authup/access';
+import type { IClientRepository } from '../../entities/client/types.ts';
+import type { IRobotRepository } from '../../entities/robot/types.ts';
+import type { IRoleRepository } from '../../entities/role/types.ts';
+import type { IUserRepository } from '../../entities/user/types.ts';
+import type { IIdentityRoleProvider } from '../role/types.ts';
 export type ResolveJunctionPolicyOptions = {
     name: string;
     realmId?: string | null;
@@ -10,18 +15,11 @@ export interface IIdentityPermissionProvider {
     isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData): Promise<boolean>;
     resolveJunctionPolicy(identity: IdentityPolicyData, options: ResolveJunctionPolicyOptions): Promise<Policy | undefined>;
 }
-export interface IIdentityBindingRepository {
-    getBoundPermissions(entity: string): Promise<PermissionPolicyBinding[]>;
-    getBoundRoles(entity: string): Promise<Role[]>;
-}
-export interface IRoleBindingRepository {
-    getBoundPermissions(entity: string | Role): Promise<PermissionPolicyBinding[]>;
-    getBoundPermissionsForMany(entities: (string | Role)[]): Promise<PermissionPolicyBinding[]>;
-}
 export type IdentityPermissionProviderContext = {
-    clientRepository: IIdentityBindingRepository;
-    userRepository: IIdentityBindingRepository;
-    robotRepository: IIdentityBindingRepository;
-    roleRepository: IRoleBindingRepository;
+    clientRepository: IClientRepository;
+    userRepository: IUserRepository;
+    robotRepository: IRobotRepository;
+    roleRepository: IRoleRepository;
+    roleProvider: IIdentityRoleProvider;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/core/identity/permission/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EACR,kBAAkB,EAClB,uBAAuB,EAC1B,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACzE,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC3H;AAED,MAAM,WAAW,0BAA0B;IACvC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACxE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,sBAAsB;IACnC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC/E,0BAA0B,CAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CAC/F;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC5C,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,cAAc,EAAE,0BAA0B,CAAC;IAC3C,eAAe,EAAE,0BAA0B,CAAC;IAC5C,cAAc,EAAE,sBAAsB,CAAC;CAC1C,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EACR,kBAAkB,EAClB,uBAAuB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9D,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACzE,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC3H;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC5C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,EAAE,gBAAgB,CAAC;IAClC,cAAc,EAAE,eAAe,CAAC;IAChC,YAAY,EAAE,qBAAqB,CAAC;CACvC,CAAC"}

package/dist/core/identity/role/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/role/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/role/index.mjs

@@ -0,0 +1,2 @@
+import { IdentityRoleProvider } from "./module.mjs";
+export { IdentityRoleProvider };

package/dist/core/identity/role/module.d.ts

@@ -0,0 +1,15 @@
+import type { Role } from '@authup/core-kit';
+import type { IdentityPolicyData } from '@authup/access';
+import type { IClientRepository } from '../../entities/client/types.ts';
+import type { IRobotRepository } from '../../entities/robot/types.ts';
+import type { IUserRepository } from '../../entities/user/types.ts';
+import type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';
+export declare class IdentityRoleProvider implements IIdentityRoleProvider {
+    protected clientRepository: IClientRepository;
+    protected userRepository: IUserRepository;
+    protected robotRepository: IRobotRepository;
+    constructor(ctx: IdentityRoleProviderContext);
+    getRolesFor(identity: IdentityPolicyData): Promise<Role[]>;
+    private reduceByIdentityClient;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/identity/role/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAErF,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,2BAA2B;IAMtC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAkBjE,OAAO,CAAC,sBAAsB;CAUjC"}

package/dist/core/identity/role/module.mjs

@@ -0,0 +1,27 @@
+//#region src/core/identity/role/module.ts
+var IdentityRoleProvider = class {
+	clientRepository;
+	userRepository;
+	robotRepository;
+	constructor(ctx) {
+		this.clientRepository = ctx.clientRepository;
+		this.userRepository = ctx.userRepository;
+		this.robotRepository = ctx.robotRepository;
+	}
+	async getRolesFor(identity) {
+		switch (identity.type) {
+			case "client": return this.clientRepository.getBoundRoles(identity.id);
+			case "user": return this.userRepository.getBoundRoles(identity.id).then((data) => this.reduceByIdentityClient(data, identity));
+			case "robot": return this.robotRepository.getBoundRoles(identity.id).then((data) => this.reduceByIdentityClient(data, identity));
+		}
+		return [];
+	}
+	reduceByIdentityClient(entities, identity) {
+		if (!identity.clientId) return entities;
+		return entities.filter((entity) => entity.client_id === identity.clientId);
+	}
+};
+//#endregion
+export { IdentityRoleProvider };
+
+//# sourceMappingURL=module.mjs.map