@authup/server-core 1.0.0-beta.37 → 1.0.0-beta.38

package/dist/core/identity/role/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","robotRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity","client_id"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n            case 'robot': {\n                return this.robotRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { client_id?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        return entities.filter((entity) => entity.client_id === identity.clientId);\n    }\n}\n"],"mappings":";AAcA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;AAC1C,OAAKH,mBAAmBG,IAAIH;AAC5B,OAAKC,iBAAiBE,IAAIF;AAC1B,OAAKC,kBAAkBC,IAAID;;CAG/B,MAAME,YAAYC,UAAgD;AAC9D,UAAQA,SAASC,MAAjB;GACI,KAAK,SACD,QAAO,KAAKN,iBAAiBO,cAAcF,SAASG,GAAE;GAE1D,KAAK,OACD,QAAO,KAAKP,eAAeM,cAAcF,SAASG,GAAE,CAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,SAAAA,CAAAA;GAE1D,KAAK,QACD,QAAO,KAAKH,gBAAgBK,cAAcF,SAASG,GAAE,CAChDC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,SAAAA,CAAAA;;AAI9D,SAAO,EAAE;;CAGLM,uBACJC,UACAP,UACG;AACH,MAAI,CAACA,SAASQ,SACV,QAAOD;AAGX,SAAOA,SAASE,QAAQC,WAAWA,OAAOC,cAAcX,SAASQ,SAAQ"}

package/dist/core/identity/role/types.d.ts

@@ -0,0 +1,14 @@
+import type { Role } from '@authup/core-kit';
+import type { IdentityPolicyData } from '@authup/access';
+import type { IClientRepository } from '../../entities/client/types.ts';
+import type { IRobotRepository } from '../../entities/robot/types.ts';
+import type { IUserRepository } from '../../entities/user/types.ts';
+export interface IIdentityRoleProvider {
+    getRolesFor(identity: IdentityPolicyData): Promise<Role[]>;
+}
+export type IdentityRoleProviderContext = {
+    clientRepository: IClientRepository;
+    userRepository: IUserRepository;
+    robotRepository: IRobotRepository;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/role/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,MAAM,WAAW,qBAAqB;IAClC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;CAC9D;AAED,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC"}

package/dist/core/identity/role/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/index.mjs

@@ -74,6 +74,7 @@ import { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN } from "./identit
 import { createIdentityProviderOAuth2Authenticator } from "./identity/provider/authentication/factory.mjs";
 import { RegistrationService } from "./identity/registration/service.mjs";
 import { IdentityResolver } from "./identity/resolver/module.mjs";
+import { IdentityRoleProvider } from "./identity/role/module.mjs";
 import "./identity/index.mjs";
 import { ProvisioningEntityStrategyType } from "./provisioning/strategy/constants.mjs";
 import { normalizeEntityProvisioningStrategy } from "./provisioning/strategy/normalize.mjs";
@@ -101,4 +102,4 @@ import "./provisioning/index.mjs";
 import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mjs";
 import { PolicyEngine } from "./security/policy/engine.mjs";
 import "./security/index.mjs";
-export { AbstractEntityService, BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionPolicyService, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createIdentityProviderOAuth2Authenticator, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };
+export { AbstractEntityService, BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionPolicyService, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createIdentityProviderOAuth2Authenticator, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };

package/dist/core/oauth2/token/issuer/access/module.d.ts

@@ -3,10 +3,13 @@ import type { IOAuth2TokenSigner } from '../../signer/index.ts';
 import type { IOAuth2TokenRepository } from '../../repository/index.ts';
 import { OAuth2BaseTokenIssuer } from '../base.ts';
 import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';
+import type { IIdentityRoleProvider } from '../../../../identity/index.ts';
 export declare class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {
     protected repository: IOAuth2TokenRepository;
     protected signer: IOAuth2TokenSigner;
-    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions);
+    protected identityRoleProvider?: IIdentityRoleProvider;
+    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions, identityRoleProvider?: IIdentityRoleProvider);
     issue(input?: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
+    protected buildAccessClaims(input: OAuth2TokenPayload): Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/issuer/access/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3G,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;gBAGlC,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B;IAQpC,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;CAgBnF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;gBAGnD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,oBAAoB,CAAC,EAAE,qBAAqB;IAS1C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;cAoBhE,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,eAAe,CAAC,CAAC;CA6BrI"}

package/dist/core/oauth2/token/issuer/access/module.mjs

@@ -4,23 +4,45 @@ import { OAuth2TokenKind } from "@authup/specs";
 var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
 	repository;
 	signer;
-	constructor(repository, signer, options = {}) {
+	identityRoleProvider;
+	constructor(repository, signer, options = {}, identityRoleProvider) {
 		super(options);
 		this.repository = repository;
 		this.signer = signer;
+		this.identityRoleProvider = identityRoleProvider;
 	}
 	async issue(input = {}) {
 		const iss = this.buildIss(input);
+		const accessClaims = await this.buildAccessClaims(input);
 		const data = await this.repository.insert({
 			...input,
 			kind: OAuth2TokenKind.ACCESS,
 			exp: this.buildExp(input),
-			...iss ? { iss } : {}
+			...iss ? { iss } : {},
+			...accessClaims
 		});
 		const token = await this.signer.sign(data);
 		await this.repository.saveWithSignature(data, token);
 		return [token, data];
 	}
+	async buildAccessClaims(input) {
+		if (!this.identityRoleProvider || !input.sub || !input.sub_kind) return {};
+		const roles = await this.identityRoleProvider.getRolesFor({
+			type: input.sub_kind,
+			id: input.sub,
+			clientId: input.client_id,
+			realmId: input.realm_id,
+			realmName: input.realm_name
+		});
+		const realmRoles = [];
+		const globalRoles = [];
+		for (const role of roles) if (!role.realm_id) globalRoles.push(role.name);
+		else if (input.realm_id && role.realm_id === input.realm_id) realmRoles.push(role.name);
+		return {
+			realm_access: { roles: realmRoles },
+			global_access: { roles: globalRoles }
+		};
+	}
 };
 //#endregion
 export { OAuth2AccessTokenIssuer };

package/dist/core/oauth2/token/issuer/access/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","options","issue","input","iss","buildIss","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;AAcA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEV,YACID,YACAC,QACAC,UAAoC,EAAE,EACxC;AACE,QAAMA,QAAAA;AAEN,OAAKF,aAAaA;AAClB,OAAKC,SAASA;;CAGlB,MAAME,MAAMC,QAA4B,EAAE,EAAuC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,MAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKP,WAAWQ,OAAO;GACtC,GAAGJ;GACHK,MAAMZ,gBAAgBa;GACtBC,KAAK,KAAKC,SAASR,MAAAA;GACnB,GAAIC,MAAM,EAAEA,KAAI,GAAI,EAAE;GAC1B,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKZ,OAAOa,KAAKP,KAAAA;AAErC,QAAM,KAAKP,WAAWe,kBAAkBR,MAAMM,MAAAA;AAE9C,SAAO,CAACA,OAAON,KAAK"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","sub","sub_kind","roles","getRolesFor","type","id","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realm_id) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realm_id === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;AAeA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,EAAE,EACtCD,sBACF;AACE,QAAMC,QAAAA;AAEN,OAAKH,aAAaA;AAClB,OAAKC,SAASA;AACd,OAAKC,uBAAuBA;;CAGhC,MAAME,MAAMC,QAA4B,EAAE,EAAuC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,MAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,MAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKV,WAAWW,OAAO;GACtC,GAAGN;GACHO,MAAMf,gBAAgBgB;GACtBC,KAAK,KAAKC,SAASV,MAAAA;GACnB,GAAIC,MAAM,EAAEA,KAAI,GAAI,EAAE;GACtB,GAAGE;GACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKf,OAAOgB,KAAKP,KAAAA;AAErC,QAAM,KAAKV,WAAWkB,kBAAkBR,MAAMM,MAAAA;AAE9C,SAAO,CAACA,OAAON,KAAK;;CAGxB,MAAgBD,kBAAkBJ,OAAiG;AAC/H,MAAI,CAAC,KAAKH,wBAAwB,CAACG,MAAMc,OAAO,CAACd,MAAMe,SACnD,QAAO,EAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAKnB,qBAAqBoB,YAAY;GACtDC,MAAMlB,MAAMe;GACZI,IAAInB,MAAMc;GACVM,UAAUpB,MAAMqB;GAChBC,SAAStB,MAAMuB;GACfC,WAAWxB,MAAMyB;GACrB,CAAA;EAEA,MAAMC,aAAuB,EAAE;EAC/B,MAAMC,cAAwB,EAAE;AAEhC,OAAK,MAAMC,QAAQZ,MACf,KAAI,CAACY,KAAKL,SACNI,aAAYE,KAAKD,KAAKE,KAAI;WACnB9B,MAAMuB,YAAYK,KAAKL,aAAavB,MAAMuB,SACjDG,YAAWG,KAAKD,KAAKE,KAAI;AAIjC,SAAO;GACHC,cAAc,EAAEf,OAAOU,YAAW;GAClCM,eAAe,EAAEhB,OAAOW,aAAY;GACxC"}

package/dist/core/provisioning/entities/permission/types.d.ts

@@ -1,6 +1,14 @@
 import type { Permission } from '@authup/core-kit';
 import type { BaseProvisioningEntity } from '../types.ts';
+export type PermissionProvisioningRelations = {
+    /**
+     * Policy names to attach to this permission via auth_permission_policies.
+     * Resolved to IDs and inserted as junction rows during provisioning.
+     */
+    policies?: string[];
+};
 export type PermissionProvisioningEntity = BaseProvisioningEntity<Permission> & {
     attributes: Partial<Permission>;
+    relations?: PermissionProvisioningRelations;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/entities/permission/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/permission/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,MAAM,4BAA4B,GAAG,sBAAsB,CAAC,UAAU,CAAC,GAAG;IAC5E,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;CAClC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/permission/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,MAAM,+BAA+B,GAAG;IAC1C;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,sBAAsB,CAAC,UAAU,CAAC,GAAG;IAC5E,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,+BAA+B,CAAC;CAC/C,CAAC"}

package/dist/core/provisioning/synchronizer/permission/module.d.ts

@@ -1,10 +1,14 @@
-import type { IPermissionRepository } from '../../../entities/index.ts';
+import type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';
+import type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';
 import type { PermissionProvisioningEntity } from '../../entities/permission';
 import { BaseProvisioningSynchronizer } from '../base.ts';
 import type { PermissionProvisioningSynchronizerContext } from './types.ts';
 export declare class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {
     protected repository: IPermissionRepository;
+    protected policyRepository?: IPolicyRepository;
+    protected permissionPolicyRepository?: IPermissionPolicyRepository;
     constructor(ctx: PermissionProvisioningSynchronizerContext);
     synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity>;
+    private synchronizePolicies;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/synchronizer/permission/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,YAAY,CAAC;AAE5E,qBAAa,kCAAmC,SAAQ,4BAA4B,CAAC,4BAA4B,CAAC;IAC9G,SAAS,CAAC,UAAU,EAAG,qBAAqB,CAAC;gBAEjC,GAAG,EAAE,yCAAyC;IAMpD,WAAW,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,4BAA4B,CAAC;CA6ChG"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,YAAY,CAAC;AAE5E,qBAAa,kCAAmC,SAAQ,4BAA4B,CAAC,4BAA4B,CAAC;IAC9G,SAAS,CAAC,UAAU,EAAG,qBAAqB,CAAC;IAE7C,SAAS,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,CAAC,EAAE,2BAA2B,CAAC;gBAEvD,GAAG,EAAE,yCAAyC;IAQpD,WAAW,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,4BAA4B,CAAC;YAkD/E,mBAAmB;CAgCpC"}

package/dist/core/provisioning/synchronizer/permission/module.mjs

@@ -6,9 +6,13 @@ import { pickRecord } from "@authup/kit";
 //#region src/core/provisioning/synchronizer/permission/module.ts
 var PermissionProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 	repository;
+	policyRepository;
+	permissionPolicyRepository;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
+		this.policyRepository = ctx.policyRepository;
+		this.permissionPolicyRepository = ctx.permissionPolicyRepository;
 	}
 	async synchronize(input) {
 		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
@@ -35,11 +39,30 @@ var PermissionProvisioningSynchronizer = class extends BaseProvisioningSynchroni
 				break;
 		}
 		else attributes = await this.repository.save(this.repository.create(input.attributes));
+		if (input.relations?.policies && input.relations.policies.length > 0) await this.synchronizePolicies(attributes, input.relations.policies);
 		return {
 			...input,
 			attributes
 		};
 	}
+	async synchronizePolicies(permission, policyNames) {
+		if (!this.policyRepository || !this.permissionPolicyRepository) throw new Error("Provisioning: policy/permissionPolicy repositories must be wired to attach policies to permissions.");
+		for (const policyName of policyNames) {
+			const policy = await this.policyRepository.findOneByName(policyName);
+			if (!policy) throw new Error(`Provisioning: policy '${policyName}' not found for permission '${permission.name}'.`);
+			if (await this.permissionPolicyRepository.findOneBy({
+				permission_id: permission.id,
+				policy_id: policy.id
+			})) continue;
+			const entry = this.permissionPolicyRepository.create({
+				permission_id: permission.id,
+				permission_realm_id: permission.realm_id,
+				policy_id: policy.id,
+				policy_realm_id: policy.realm_id
+			});
+			await this.permissionPolicyRepository.save(entry);
+		}
+	}
 };
 //#endregion
 export { PermissionProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","PermissionProvisioningSynchronizer","repository","ctx","synchronize","input","strategy","attributes","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IPermissionRepository } from '../../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PermissionProvisioningSynchronizerContext } from './types.ts';\n\nexport class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {\n    protected repository : IPermissionRepository;\n\n    constructor(ctx: PermissionProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n    }\n\n    async synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n            client_id: input.attributes.client_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaI,qCAAb,cAAwDD,6BAAAA;CAC1CE;CAEV,YAAYC,KAAgD;AACxD,SAAK;AAEL,OAAKD,aAAaC,IAAID;;CAG1B,MAAME,YAAYC,OAA4E;EAC1F,MAAMC,WAAWP,oCAAoCM,MAAMC,SAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKL,WAAWM,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GACvCC,WAAWN,MAAME,WAAWI,aAAa;GAC7C,CAAA;AAEA,MAAIL,SAASM,SAASd,+BAA+Be,QAAQ;AACzD,OAAIN,WACA,OAAM,KAAKL,WAAWY,OAAOP,WAAAA;AAEjC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASM,MAAjB;GACI,KAAKd,+BAA+BiB;AAChCR,iBAAa,KAAKL,WAAWc,MACzBT,YACAD,SAASC,aACLV,WAAWQ,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKL,WAAWe,KAAKV,WAAAA;AACxC;GACJ,KAAKT,+BAA+BoB;AAChCb,UAAME,WAAWY,KAAKZ,WAAWY;AACjCZ,iBAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,WAAU,CAAA;AAC/E;;MAGRA,cAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,WAAU,CAAA;AAGnF,SAAO;GACH,GAAGF;GACHE;GACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","PermissionProvisioningSynchronizer","repository","policyRepository","permissionPolicyRepository","ctx","synchronize","input","strategy","attributes","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","policies","length","synchronizePolicies","permission","policyNames","Error","policyName","policy","findOneByName","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id"],"sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PermissionProvisioningSynchronizerContext } from './types.ts';\n\nexport class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {\n    protected repository : IPermissionRepository;\n\n    protected policyRepository?: IPolicyRepository;\n\n    protected permissionPolicyRepository?: IPermissionPolicyRepository;\n\n    constructor(ctx: PermissionProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n            client_id: input.attributes.client_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes,\n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations?.policies && input.relations.policies.length > 0) {\n            await this.synchronizePolicies(attributes, input.relations.policies);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private async synchronizePolicies(permission: Permission, policyNames: string[]): Promise<void> {\n        if (!this.policyRepository || !this.permissionPolicyRepository) {\n            throw new Error(\n                'Provisioning: policy/permissionPolicy repositories must be wired to attach policies to permissions.',\n            );\n        }\n\n        for (const policyName of policyNames) {\n            const policy = await this.policyRepository.findOneByName(policyName);\n            if (!policy) {\n                throw new Error(\n                    `Provisioning: policy '${policyName}' not found for permission '${permission.name}'.`,\n                );\n            }\n\n            const existing = await this.permissionPolicyRepository.findOneBy({\n                permission_id: permission.id,\n                policy_id: policy.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.permissionPolicyRepository.create({\n                permission_id: permission.id,\n                permission_realm_id: permission.realm_id,\n                policy_id: policy.id,\n                policy_realm_id: policy.realm_id,\n            });\n            await this.permissionPolicyRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;AAgBA,IAAaI,qCAAb,cAAwDD,6BAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;AACxD,SAAK;AAEL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,mBAAmBE,IAAIF;AAC5B,OAAKC,6BAA6BC,IAAID;;CAG1C,MAAME,YAAYC,OAA4E;EAC1F,MAAMC,WAAWT,oCAAoCQ,MAAMC,SAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKP,WAAWQ,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GACvCC,WAAWN,MAAME,WAAWI,aAAa;GAC7C,CAAA;AAEA,MAAIL,SAASM,SAAShB,+BAA+BiB,QAAQ;AACzD,OAAIN,WACA,OAAM,KAAKP,WAAWc,OAAOP,WAAAA;AAEjC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASM,MAAjB;GACI,KAAKhB,+BAA+BmB;AAChCR,iBAAa,KAAKP,WAAWgB,MACzBT,YACAD,SAASC,aACLZ,WAAWU,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKP,WAAWiB,KAAKV,WAAAA;AACxC;GACJ,KAAKX,+BAA+BsB;AAChCb,UAAME,WAAWY,KAAKZ,WAAWY;AACjCZ,iBAAa,MAAM,KAAKP,WAAWiB,KAAK,KAAKjB,WAAWoB,OAAOf,MAAME,WAAU,CAAA;AAC/E;;MAGRA,cAAa,MAAM,KAAKP,WAAWiB,KAAK,KAAKjB,WAAWoB,OAAOf,MAAME,WAAU,CAAA;AAGnF,MAAIF,MAAMgB,WAAWC,YAAYjB,MAAMgB,UAAUC,SAASC,SAAS,EAC/D,OAAM,KAAKC,oBAAoBjB,YAAYF,MAAMgB,UAAUC,SAAQ;AAGvE,SAAO;GACH,GAAGjB;GACHE;GACJ;;CAGJ,MAAciB,oBAAoBC,YAAwBC,aAAsC;AAC5F,MAAI,CAAC,KAAKzB,oBAAoB,CAAC,KAAKC,2BAChC,OAAM,IAAIyB,MACN,sGAAA;AAIR,OAAK,MAAMC,cAAcF,aAAa;GAClC,MAAMG,SAAS,MAAM,KAAK5B,iBAAiB6B,cAAcF,WAAAA;AACzD,OAAI,CAACC,OACD,OAAM,IAAIF,MACN,yBAAyBC,WAAW,8BAA8BH,WAAWhB,KAAK,IAAG;AAQ7F,OAAIsB,MAJmB,KAAK7B,2BAA2BM,UAAU;IAC7DwB,eAAeP,WAAWN;IAC1Bc,WAAWJ,OAAOV;IACtB,CAAA,CAEI;GAGJ,MAAMe,QAAQ,KAAKhC,2BAA2BkB,OAAO;IACjDY,eAAeP,WAAWN;IAC1BgB,qBAAqBV,WAAWf;IAChCuB,WAAWJ,OAAOV;IAClBiB,iBAAiBP,OAAOnB;IAC5B,CAAA;AACA,SAAM,KAAKR,2BAA2Be,KAAKiB,MAAAA"}

package/dist/core/provisioning/synchronizer/permission/types.d.ts

@@ -1,5 +1,8 @@
-import type { IPermissionRepository } from '../../../entities/index.ts';
+import type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';
+import type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';
 export type PermissionProvisioningSynchronizerContext = {
     repository: IPermissionRepository;
+    policyRepository?: IPolicyRepository;
+    permissionPolicyRepository?: IPermissionPolicyRepository;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/permission/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,MAAM,MAAM,yCAAyC,GAAG;IACpD,UAAU,EAAE,qBAAqB,CAAC;CACrC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE3F,MAAM,MAAM,yCAAyC,GAAG;IACpD,UAAU,EAAE,qBAAqB,CAAC;IAClC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,0BAA0B,CAAC,EAAE,2BAA2B,CAAC;CAC5D,CAAC"}

package/dist/core/provisioning/synchronizer/policy/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,8BAA+B,SAAQ,4BAA4B,CAAC,wBAAwB,CAAC;IACtG,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,GAAG,EAAE,qCAAqC;IAOhD,WAAW,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;YA2BvE,mBAAmB;YAgBnB,oBAAoB;YAgBpB,iBAAiB;CAclC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,8BAA+B,SAAQ,4BAA4B,CAAC,wBAAwB,CAAC;IACtG,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,GAAG,EAAE,qCAAqC;IAOhD,WAAW,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;YAmCvE,mBAAmB;YAgBnB,oBAAoB;YAgBpB,iBAAiB;CAclC"}

package/dist/core/provisioning/synchronizer/policy/module.mjs

@@ -14,12 +14,14 @@ var PolicyProvisioningSynchronizer = class extends BaseProvisioningSynchronizer
 			realm_id: input.attributes.realm_id || null
 		});
 		if (entity) {
-			entity = this.repository.merge(entity, {
+			const mergeData = {
 				type: input.attributes.type,
 				built_in: input.attributes.built_in,
 				parent_id: input.attributes.parent_id,
 				parent: input.attributes.parent
-			});
+			};
+			if (typeof input.attributes.invert !== "undefined") mergeData.invert = input.attributes.invert;
+			entity = this.repository.merge(entity, mergeData);
 			await this.repository.saveWithEA(entity, input.extraAttributes);
 		} else {
 			entity = this.repository.create(input.attributes);

package/dist/core/provisioning/synchronizer/policy/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BaseProvisioningSynchronizer","PolicyProvisioningSynchronizer","repository","permissionPolicyRepository","ctx","synchronize","input","entity","findOneBy","name","attributes","realm_id","merge","type","built_in","parent_id","parent","saveWithEA","extraAttributes","create","synchronizeChildren","id","children","parentId","declaredNames","map","c","reduce","prev","child","Promise","resolve","cleanupStaleChildren","existingChildren","findManyBy","staleChildren","filter","includes","cleanupStaleChild","referencingJunctions","policy_id","length","deleteFromTree","detached"],"sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Policy } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPolicyRepository } from '../../../entities/index.ts';\nimport type { PolicyProvisioningEntity } from '../../entities/policy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PolicyProvisioningSynchronizerContext } from './types.ts';\n\nexport class PolicyProvisioningSynchronizer extends BaseProvisioningSynchronizer<PolicyProvisioningEntity> {\n    protected repository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    constructor(ctx: PolicyProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PolicyProvisioningEntity): Promise<PolicyProvisioningEntity> {\n        let entity = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (entity) {\n            entity = this.repository.merge(entity, {\n                type: input.attributes.type,\n                built_in: input.attributes.built_in,\n                parent_id: input.attributes.parent_id,\n                parent: input.attributes.parent,\n            });\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        } else {\n            entity = this.repository.create(input.attributes);\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        }\n\n        await this.synchronizeChildren(entity.id, input.children || []);\n\n        return {\n            ...input,\n            attributes: entity,\n        };\n    }\n\n    private async synchronizeChildren(\n        parentId: string,\n        children: PolicyProvisioningEntity[] = [],\n    ): Promise<void> {\n        const declaredNames = children.map((c) => c.attributes.name);\n\n        await children.reduce(async (prev, child) => {\n            await prev;\n            child.attributes.parent_id = parentId;\n            child.attributes.parent = { id: parentId } as any;\n            await this.synchronize(child);\n        }, Promise.resolve());\n\n        await this.cleanupStaleChildren(parentId, declaredNames);\n    }\n\n    private async cleanupStaleChildren(\n        parentId: string,\n        declaredNames: (string | undefined)[],\n    ): Promise<void> {\n        const existingChildren = await this.repository.findManyBy({ parent_id: parentId });\n\n        const staleChildren = existingChildren.filter(\n            (child) => !declaredNames.includes(child.name),\n        );\n\n        await staleChildren.reduce(async (prev, child) => {\n            await prev;\n            await this.cleanupStaleChild(child);\n        }, Promise.resolve());\n    }\n\n    private async cleanupStaleChild(child: Policy): Promise<void> {\n        const referencingJunctions = await this.permissionPolicyRepository.findManyBy({ policy_id: child.id });\n\n        if (referencingJunctions.length === 0) {\n            await this.repository.deleteFromTree(child);\n        } else {\n            const detached = this.repository.merge(child, {\n                parent_id: null,\n                parent: null,\n                built_in: false,\n            });\n            await this.repository.saveWithEA(detached);\n        }\n    }\n}\n"],"mappings":";;AAcA,IAAaC,iCAAb,cAAoDD,6BAAAA;CACtCE;CAEAC;CAEV,YAAYC,KAA4C;AACpD,SAAK;AAEL,OAAKF,aAAaE,IAAIF;AACtB,OAAKC,6BAA6BC,IAAID;;CAG1C,MAAME,YAAYC,OAAoE;EAClF,IAAIC,SAAS,MAAM,KAAKL,WAAWM,UAAU;GACzCC,MAAMH,MAAMI,WAAWD;GACvBE,UAAUL,MAAMI,WAAWC,YAAY;GAC3C,CAAA;AAEA,MAAIJ,QAAQ;AACRA,YAAS,KAAKL,WAAWU,MAAML,QAAQ;IACnCM,MAAMP,MAAMI,WAAWG;IACvBC,UAAUR,MAAMI,WAAWI;IAC3BC,WAAWT,MAAMI,WAAWK;IAC5BC,QAAQV,MAAMI,WAAWM;IAC7B,CAAA;AACA,SAAM,KAAKd,WAAWe,WAAWV,QAAQD,MAAMY,gBAAe;SAC3D;AACHX,YAAS,KAAKL,WAAWiB,OAAOb,MAAMI,WAAU;AAChD,SAAM,KAAKR,WAAWe,WAAWV,QAAQD,MAAMY,gBAAe;;AAGlE,QAAM,KAAKE,oBAAoBb,OAAOc,IAAIf,MAAMgB,YAAY,EAAE,CAAA;AAE9D,SAAO;GACH,GAAGhB;GACHI,YAAYH;GAChB;;CAGJ,MAAca,oBACVG,UACAD,WAAuC,EAAE,EAC5B;EACb,MAAME,gBAAgBF,SAASG,KAAKC,MAAMA,EAAEhB,WAAWD,KAAI;AAE3D,QAAMa,SAASK,OAAO,OAAOC,MAAMC,UAAAA;AAC/B,SAAMD;AACNC,SAAMnB,WAAWK,YAAYQ;AAC7BM,SAAMnB,WAAWM,SAAS,EAAEK,IAAIE,UAAS;AACzC,SAAM,KAAKlB,YAAYwB,MAAAA;KACxBC,QAAQC,SAAO,CAAA;AAElB,QAAM,KAAKC,qBAAqBT,UAAUC,cAAAA;;CAG9C,MAAcQ,qBACVT,UACAC,eACa;AAOb,SAJsBS,MAFS,KAAK/B,WAAWgC,WAAW,EAAEnB,WAAWQ,UAAS,CAAA,EAEzCa,QAClCP,UAAU,CAACL,cAAca,SAASR,MAAMpB,KAAI,CAG3C0B,CAAcR,OAAO,OAAOC,MAAMC,UAAAA;AACpC,SAAMD;AACN,SAAM,KAAKU,kBAAkBT,MAAAA;KAC9BC,QAAQC,SAAO,CAAA;;CAGtB,MAAcO,kBAAkBT,OAA8B;AAG1D,OAAIU,MAF+B,KAAKpC,2BAA2B+B,WAAW,EAAEM,WAAWX,MAAMR,IAAG,CAAA,EAE3EoB,WAAW,EAChC,OAAM,KAAKvC,WAAWwC,eAAeb,MAAAA;OAClC;GACH,MAAMc,WAAW,KAAKzC,WAAWU,MAAMiB,OAAO;IAC1Cd,WAAW;IACXC,QAAQ;IACRF,UAAU;IACd,CAAA;AACA,SAAM,KAAKZ,WAAWe,WAAW0B,SAAAA"}
+{"version":3,"file":"module.mjs","names":["BaseProvisioningSynchronizer","PolicyProvisioningSynchronizer","repository","permissionPolicyRepository","ctx","synchronize","input","entity","findOneBy","name","attributes","realm_id","mergeData","type","built_in","parent_id","parent","invert","merge","saveWithEA","extraAttributes","create","synchronizeChildren","id","children","parentId","declaredNames","map","c","reduce","prev","child","Promise","resolve","cleanupStaleChildren","existingChildren","findManyBy","staleChildren","filter","includes","cleanupStaleChild","referencingJunctions","policy_id","length","deleteFromTree","detached"],"sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Policy } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPolicyRepository } from '../../../entities/index.ts';\nimport type { PolicyProvisioningEntity } from '../../entities/policy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PolicyProvisioningSynchronizerContext } from './types.ts';\n\nexport class PolicyProvisioningSynchronizer extends BaseProvisioningSynchronizer<PolicyProvisioningEntity> {\n    protected repository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    constructor(ctx: PolicyProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PolicyProvisioningEntity): Promise<PolicyProvisioningEntity> {\n        let entity = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (entity) {\n            // Only assign `invert` when the source declares it explicitly.\n            // TypeORM's `merge` is a plain assign and would otherwise clobber\n            // an existing flag with `undefined` (turning `invert: true` into\n            // `null`/`false` on every reprovisioning pass).\n            const mergeData: Partial<Policy> = {\n                type: input.attributes.type,\n                built_in: input.attributes.built_in,\n                parent_id: input.attributes.parent_id,\n                parent: input.attributes.parent,\n            };\n            if (typeof input.attributes.invert !== 'undefined') {\n                mergeData.invert = input.attributes.invert;\n            }\n            entity = this.repository.merge(entity, mergeData);\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        } else {\n            entity = this.repository.create(input.attributes);\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        }\n\n        await this.synchronizeChildren(entity.id, input.children || []);\n\n        return {\n            ...input,\n            attributes: entity,\n        };\n    }\n\n    private async synchronizeChildren(\n        parentId: string,\n        children: PolicyProvisioningEntity[] = [],\n    ): Promise<void> {\n        const declaredNames = children.map((c) => c.attributes.name);\n\n        await children.reduce(async (prev, child) => {\n            await prev;\n            child.attributes.parent_id = parentId;\n            child.attributes.parent = { id: parentId } as any;\n            await this.synchronize(child);\n        }, Promise.resolve());\n\n        await this.cleanupStaleChildren(parentId, declaredNames);\n    }\n\n    private async cleanupStaleChildren(\n        parentId: string,\n        declaredNames: (string | undefined)[],\n    ): Promise<void> {\n        const existingChildren = await this.repository.findManyBy({ parent_id: parentId });\n\n        const staleChildren = existingChildren.filter(\n            (child) => !declaredNames.includes(child.name),\n        );\n\n        await staleChildren.reduce(async (prev, child) => {\n            await prev;\n            await this.cleanupStaleChild(child);\n        }, Promise.resolve());\n    }\n\n    private async cleanupStaleChild(child: Policy): Promise<void> {\n        const referencingJunctions = await this.permissionPolicyRepository.findManyBy({ policy_id: child.id });\n\n        if (referencingJunctions.length === 0) {\n            await this.repository.deleteFromTree(child);\n        } else {\n            const detached = this.repository.merge(child, {\n                parent_id: null,\n                parent: null,\n                built_in: false,\n            });\n            await this.repository.saveWithEA(detached);\n        }\n    }\n}\n"],"mappings":";;AAcA,IAAaC,iCAAb,cAAoDD,6BAAAA;CACtCE;CAEAC;CAEV,YAAYC,KAA4C;AACpD,SAAK;AAEL,OAAKF,aAAaE,IAAIF;AACtB,OAAKC,6BAA6BC,IAAID;;CAG1C,MAAME,YAAYC,OAAoE;EAClF,IAAIC,SAAS,MAAM,KAAKL,WAAWM,UAAU;GACzCC,MAAMH,MAAMI,WAAWD;GACvBE,UAAUL,MAAMI,WAAWC,YAAY;GAC3C,CAAA;AAEA,MAAIJ,QAAQ;GAKR,MAAMK,YAA6B;IAC/BC,MAAMP,MAAMI,WAAWG;IACvBC,UAAUR,MAAMI,WAAWI;IAC3BC,WAAWT,MAAMI,WAAWK;IAC5BC,QAAQV,MAAMI,WAAWM;IAC7B;AACA,OAAI,OAAOV,MAAMI,WAAWO,WAAW,YACnCL,WAAUK,SAASX,MAAMI,WAAWO;AAExCV,YAAS,KAAKL,WAAWgB,MAAMX,QAAQK,UAAAA;AACvC,SAAM,KAAKV,WAAWiB,WAAWZ,QAAQD,MAAMc,gBAAe;SAC3D;AACHb,YAAS,KAAKL,WAAWmB,OAAOf,MAAMI,WAAU;AAChD,SAAM,KAAKR,WAAWiB,WAAWZ,QAAQD,MAAMc,gBAAe;;AAGlE,QAAM,KAAKE,oBAAoBf,OAAOgB,IAAIjB,MAAMkB,YAAY,EAAE,CAAA;AAE9D,SAAO;GACH,GAAGlB;GACHI,YAAYH;GAChB;;CAGJ,MAAce,oBACVG,UACAD,WAAuC,EAAE,EAC5B;EACb,MAAME,gBAAgBF,SAASG,KAAKC,MAAMA,EAAElB,WAAWD,KAAI;AAE3D,QAAMe,SAASK,OAAO,OAAOC,MAAMC,UAAAA;AAC/B,SAAMD;AACNC,SAAMrB,WAAWK,YAAYU;AAC7BM,SAAMrB,WAAWM,SAAS,EAAEO,IAAIE,UAAS;AACzC,SAAM,KAAKpB,YAAY0B,MAAAA;KACxBC,QAAQC,SAAO,CAAA;AAElB,QAAM,KAAKC,qBAAqBT,UAAUC,cAAAA;;CAG9C,MAAcQ,qBACVT,UACAC,eACa;AAOb,SAJsBS,MAFS,KAAKjC,WAAWkC,WAAW,EAAErB,WAAWU,UAAS,CAAA,EAEzCa,QAClCP,UAAU,CAACL,cAAca,SAASR,MAAMtB,KAAI,CAG3C4B,CAAcR,OAAO,OAAOC,MAAMC,UAAAA;AACpC,SAAMD;AACN,SAAM,KAAKU,kBAAkBT,MAAAA;KAC9BC,QAAQC,SAAO,CAAA;;CAGtB,MAAcO,kBAAkBT,OAA8B;AAG1D,OAAIU,MAF+B,KAAKtC,2BAA2BiC,WAAW,EAAEM,WAAWX,MAAMR,IAAG,CAAA,EAE3EoB,WAAW,EAChC,OAAM,KAAKzC,WAAW0C,eAAeb,MAAAA;OAClC;GACH,MAAMc,WAAW,KAAK3C,WAAWgB,MAAMa,OAAO;IAC1ChB,WAAW;IACXC,QAAQ;IACRF,UAAU;IACd,CAAA;AACA,SAAM,KAAKZ,WAAWiB,WAAW0B,SAAAA"}

package/dist/index.mjs

@@ -5,6 +5,13 @@ import { CachePrefix } from "./adapters/database/domains/constants.mjs";
 import { RealmSubscriber } from "./adapters/database/domains/realm/subscriber.mjs";
 import { KeyEntity } from "./adapters/database/domains/key/entity.mjs";
 import { ClientEntity } from "./adapters/database/domains/client/entity.mjs";
+import { ClientSubscriber } from "./adapters/database/domains/client/subscriber.mjs";
+import { RoleEntity } from "./adapters/database/domains/role/entity.mjs";
+import { RoleAttributeEntity } from "./adapters/database/domains/role-attribute/entity.mjs";
+import { RoleRepository } from "./adapters/database/domains/role/repository.mjs";
+import { RoleSubscriber } from "./adapters/database/domains/role/subscriber.mjs";
+import { ClientRoleEntity } from "./adapters/database/domains/client-role/entity.mjs";
+import { ClientRoleSubscriber } from "./adapters/database/domains/client-role/subscriber.mjs";
 import { PermissionEntity } from "./adapters/database/domains/permission/entity.mjs";
 import { PermissionSubscriber } from "./adapters/database/domains/permission/subscriber.mjs";
 import { PolicyEntity } from "./adapters/database/domains/policy/entity.mjs";
@@ -14,16 +21,6 @@ import { PolicyRepository } from "./adapters/database/domains/policy/repository.
 import { PolicySubscriber } from "./adapters/database/domains/policy/subscriber.mjs";
 import { ClientPermissionEntity } from "./adapters/database/domains/client-permission/entity.mjs";
 import { ClientPermissionSubscriber } from "./adapters/database/domains/client-permission/subscriber.mjs";
-import { RoleEntity } from "./adapters/database/domains/role/entity.mjs";
-import { RoleAttributeEntity } from "./adapters/database/domains/role-attribute/entity.mjs";
-import { RolePermissionEntity } from "./adapters/database/domains/role-permission/entity.mjs";
-import { RolePermissionSubscriber } from "./adapters/database/domains/role-permission/subscriber.mjs";
-import { RoleRepository } from "./adapters/database/domains/role/repository.mjs";
-import { RoleSubscriber } from "./adapters/database/domains/role/subscriber.mjs";
-import { ClientRoleEntity } from "./adapters/database/domains/client-role/entity.mjs";
-import { ClientRoleSubscriber } from "./adapters/database/domains/client-role/subscriber.mjs";
-import { ClientRepository } from "./adapters/database/domains/client/repository.mjs";
-import { ClientSubscriber } from "./adapters/database/domains/client/subscriber.mjs";
 import { ScopeEntity } from "./adapters/database/domains/scope/entity.mjs";
 import { ScopeSubscriber } from "./adapters/database/domains/scope/subscriber.mjs";
 import { ClientScopeEntity } from "./adapters/database/domains/client-scope/entity.mjs";
@@ -36,10 +33,6 @@ import { IdentityProviderSubscriber } from "./adapters/database/domains/identity
 import { UserEntity } from "./adapters/database/domains/user/entity.mjs";
 import { UserAttributeEntity } from "./adapters/database/domains/user-attribute/entity.mjs";
 import { UserAttributeSubscriber } from "./adapters/database/domains/user-attribute/subscriber.mjs";
-import { UserPermissionEntity } from "./adapters/database/domains/user-permission/entity.mjs";
-import { UserPermissionSubscriber } from "./adapters/database/domains/user-permission/subscriber.mjs";
-import { UserRoleEntity } from "./adapters/database/domains/user-role/entity.mjs";
-import { UserRoleSubscriber } from "./adapters/database/domains/user-role/subscriber.mjs";
 import { UserRepository } from "./adapters/database/domains/user/repository.mjs";
 import { UserSubscriber } from "./adapters/database/domains/user/subscriber.mjs";
 import { IdentityProviderAccountEntity } from "./adapters/database/domains/identity-provider-account/entity.mjs";
@@ -49,15 +42,20 @@ import { IdentityProviderPermissionMappingEntity } from "./adapters/database/dom
 import { IdentityProviderRoleMappingEntity } from "./adapters/database/domains/identity-provider-role-mapping/entity.mjs";
 import { IdentityProviderRoleSubscriber } from "./adapters/database/domains/identity-provider-role-mapping/subscriber.mjs";
 import { RobotEntity } from "./adapters/database/domains/robot/entity.mjs";
-import { RobotRoleEntity } from "./adapters/database/domains/robot-role/entity.mjs";
-import { RobotRoleSubscriber } from "./adapters/database/domains/robot-role/subscriber.mjs";
-import { RobotPermissionEntity } from "./adapters/database/domains/robot-permission/entity.mjs";
-import { RobotPermissionSubscriber } from "./adapters/database/domains/robot-permission/subscriber.mjs";
-import { RobotRepository } from "./adapters/database/domains/robot/repository.mjs";
 import { RobotSubscriber } from "./adapters/database/domains/robot/subscriber.mjs";
 import { SessionEntity } from "./adapters/database/domains/session/entity.mjs";
 import { PermissionPolicyEntity } from "./adapters/database/domains/permission-policy/entity.mjs";
+import { RobotPermissionEntity } from "./adapters/database/domains/robot-permission/entity.mjs";
+import { RobotPermissionSubscriber } from "./adapters/database/domains/robot-permission/subscriber.mjs";
+import { RobotRoleEntity } from "./adapters/database/domains/robot-role/entity.mjs";
+import { RobotRoleSubscriber } from "./adapters/database/domains/robot-role/subscriber.mjs";
 import { RoleAttributeSubscriber } from "./adapters/database/domains/role-attribute/subscriber.mjs";
+import { RolePermissionEntity } from "./adapters/database/domains/role-permission/entity.mjs";
+import { RolePermissionSubscriber } from "./adapters/database/domains/role-permission/subscriber.mjs";
+import { UserPermissionEntity } from "./adapters/database/domains/user-permission/entity.mjs";
+import { UserPermissionSubscriber } from "./adapters/database/domains/user-permission/subscriber.mjs";
+import { UserRoleEntity } from "./adapters/database/domains/user-role/entity.mjs";
+import { UserRoleSubscriber } from "./adapters/database/domains/user-role/subscriber.mjs";
 import { CacheInjectionKey } from "./app/modules/cache/constants.mjs";
 import { ModuleName } from "./app/modules/constants.mjs";
 import { ConfigEnvironmentVariableName, ConfigInjectionKey } from "./app/modules/config/constants.mjs";
@@ -207,4 +205,4 @@ import { defineCLIResetCommand } from "./cli/commands/reset.mjs";
 import { defineCLIStartCommand } from "./cli/commands/start.mjs";
 import "./cli/commands/index.mjs";
 import "reflect-metadata";
-export { ActivateController, Application, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthorizationMiddleware, AuthorizeController, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepository, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountEntity, IdentityProviderAccountRepository, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyEntity, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, ProvisionerModule, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotEntity, RobotIdentityRepository, RobotPermissionController, RobotPermissionEntity, RobotPermissionRepositoryAdapter, RobotPermissionRequestValidator, RobotPermissionSubscriber, RobotRepository, RobotRepositoryAdapter, RobotRoleController, RobotRoleEntity, RobotRoleRepositoryAdapter, RobotRoleRequestValidator, RobotRoleSubscriber, RobotSubscriber, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionEntity, SessionRepository, StatusController, Swagger, SwaggerModule, TokenController, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserController, UserEntity, UserIdentityRepository, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, buildActorContext, createApplication, createAuthorizationMiddleware, createHttpServer, createLoggerMiddleware, createSwaggerMiddleware, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIResetCommand, defineCLIStartCommand, defineCLISwaggerCommand, getJwkRouteHandler, getJwksRouteHandler, getRequestBodyRealmID, getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isRequestIdentityMasterRealmMember, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, setDataSourceSync, setRequestIdentity, setRequestPermissionEvaluator, setRequestScopes, setRequestToken, unsetDataSourceSync, useDataSourceSync, useRequestIdentity, useRequestIdentityOrFail, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };
+export { ActivateController, Application, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthorizationMiddleware, AuthorizeController, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountEntity, IdentityProviderAccountRepository, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyEntity, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, ProvisionerModule, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotEntity, RobotIdentityRepository, RobotPermissionController, RobotPermissionEntity, RobotPermissionRepositoryAdapter, RobotPermissionRequestValidator, RobotPermissionSubscriber, RobotRepositoryAdapter, RobotRoleController, RobotRoleEntity, RobotRoleRepositoryAdapter, RobotRoleRequestValidator, RobotRoleSubscriber, RobotSubscriber, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionEntity, SessionRepository, StatusController, Swagger, SwaggerModule, TokenController, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserController, UserEntity, UserIdentityRepository, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, buildActorContext, createApplication, createAuthorizationMiddleware, createHttpServer, createLoggerMiddleware, createSwaggerMiddleware, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIResetCommand, defineCLIStartCommand, defineCLISwaggerCommand, getJwkRouteHandler, getJwksRouteHandler, getRequestBodyRealmID, getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isRequestIdentityMasterRealmMember, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, setDataSourceSync, setRequestIdentity, setRequestPermissionEvaluator, setRequestScopes, setRequestToken, unsetDataSourceSync, useDataSourceSync, useRequestIdentity, useRequestIdentityOrFail, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };

package/dist/path.d.ts

@@ -2,5 +2,6 @@ export declare const CODE_PATH: string;
 export declare const PACKAGE_PATH: string;
 export declare const SRC_PATH: string;
 export declare const DIST_PATH: string;
-export declare const CLIENT_WEB_SLIM_PACKAGE_PATH: string;
+export declare const UI_DIST_PATH: string;
+export declare const UI_SOURCE_PATH: string;
 //# sourceMappingURL=path.d.ts.map

package/dist/path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,SAAS,QAA+C,CAAC;AACtE,eAAO,MAAM,YAAY,QAA6B,CAAC;AACvD,eAAO,MAAM,QAAQ,QAAiC,CAAC;AACvD,eAAO,MAAM,SAAS,QAAkC,CAAC;AAEzD,eAAO,MAAM,4BAA4B,QAAmD,CAAC"}
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,SAAS,QAA+C,CAAC;AACtE,eAAO,MAAM,YAAY,QAA6B,CAAC;AACvD,eAAO,MAAM,QAAQ,QAAiC,CAAC;AACvD,eAAO,MAAM,SAAS,QAAkC,CAAC;AAEzD,eAAO,MAAM,YAAY,QAA6B,CAAC;AACvD,eAAO,MAAM,cAAc,QAAgC,CAAC"}

package/dist/path.mjs

@@ -5,8 +5,9 @@ const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));
 const PACKAGE_PATH = path.join(CODE_PATH, "..");
 const SRC_PATH = path.join(PACKAGE_PATH, "src");
 const DIST_PATH = path.join(PACKAGE_PATH, "dist");
-const CLIENT_WEB_SLIM_PACKAGE_PATH = path.join(PACKAGE_PATH, "..", "client-web-slim");
+const UI_DIST_PATH = path.join(DIST_PATH, "ui");
+const UI_SOURCE_PATH = path.join(PACKAGE_PATH, "ui");
 //#endregion
-export { CLIENT_WEB_SLIM_PACKAGE_PATH, CODE_PATH, DIST_PATH, PACKAGE_PATH, SRC_PATH };
+export { CODE_PATH, DIST_PATH, PACKAGE_PATH, SRC_PATH, UI_DIST_PATH, UI_SOURCE_PATH };
 
 //# sourceMappingURL=path.mjs.map

package/dist/path.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"path.mjs","names":["path","fileURLToPath","CODE_PATH","dirname","url","PACKAGE_PATH","join","SRC_PATH","DIST_PATH","CLIENT_WEB_SLIM_PACKAGE_PATH"],"sources":["../src/path.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));\nexport const PACKAGE_PATH = path.join(CODE_PATH, '..');\nexport const SRC_PATH = path.join(PACKAGE_PATH, 'src');\nexport const DIST_PATH = path.join(PACKAGE_PATH, 'dist');\n\nexport const CLIENT_WEB_SLIM_PACKAGE_PATH = path.join(PACKAGE_PATH, '..', 'client-web-slim');\n"],"mappings":";;;AAUA,MAAaE,YAAYF,KAAKG,QAAQF,cAAc,OAAA,KAAYG,IAAG,CAAA;AACnE,MAAaC,eAAeL,KAAKM,KAAKJ,WAAW,KAAA;AACjD,MAAaK,WAAWP,KAAKM,KAAKD,cAAc,MAAA;AAChD,MAAaG,YAAYR,KAAKM,KAAKD,cAAc,OAAA;AAEjD,MAAaI,+BAA+BT,KAAKM,KAAKD,cAAc,MAAM,kBAAA"}
+{"version":3,"file":"path.mjs","names":["path","fileURLToPath","CODE_PATH","dirname","url","PACKAGE_PATH","join","SRC_PATH","DIST_PATH","UI_DIST_PATH","UI_SOURCE_PATH"],"sources":["../src/path.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));\nexport const PACKAGE_PATH = path.join(CODE_PATH, '..');\nexport const SRC_PATH = path.join(PACKAGE_PATH, 'src');\nexport const DIST_PATH = path.join(PACKAGE_PATH, 'dist');\n\nexport const UI_DIST_PATH = path.join(DIST_PATH, 'ui');\nexport const UI_SOURCE_PATH = path.join(PACKAGE_PATH, 'ui');\n"],"mappings":";;;AAUA,MAAaE,YAAYF,KAAKG,QAAQF,cAAc,OAAA,KAAYG,IAAG,CAAA;AACnE,MAAaC,eAAeL,KAAKM,KAAKJ,WAAW,KAAA;AACjD,MAAaK,WAAWP,KAAKM,KAAKD,cAAc,MAAA;AAChD,MAAaG,YAAYR,KAAKM,KAAKD,cAAc,OAAA;AAEjD,MAAaI,eAAeT,KAAKM,KAAKE,WAAW,KAAA;AACjD,MAAaE,iBAAiBV,KAAKM,KAAKD,cAAc,KAAA"}

package/dist/swagger.json

@@ -274,6 +274,20 @@
             "type": "object",
             "additionalProperties": true
         },
+        "OAuth2AccessGrantClaim": {
+            "properties": {
+                "roles": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                }
+            },
+            "required": [
+                "roles"
+            ],
+            "type": "object"
+        },
         "OAuth2TokenPayload": {
             "type": "object",
             "properties": {