@authup/server-core 1.0.0-beta.37 → 1.0.0-beta.39

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs

@@ -1,7 +1,11 @@
 import { ScopeName } from "@authup/core-kit";
 import { isSimpleMatch } from "@authup/kit";
-import { OAuth2Error, hasOAuth2Scopes } from "@authup/specs";
+import { OAuth2AuthorizationResponseType, OAuth2Error, hasOAuth2Scopes } from "@authup/specs";
 //#region src/core/oauth2/authorization/code-request/verifier/module.ts
+function willIssueCode(responseType) {
+	if (!responseType) return false;
+	return responseType.split(" ").includes(OAuth2AuthorizationResponseType.CODE);
+}
 var OAuth2AuthorizationCodeRequestVerifier = class {
 	clientRepository;
 	scopeRepository;
@@ -17,6 +21,8 @@ var OAuth2AuthorizationCodeRequestVerifier = class {
 		const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);
 		if (!client) throw OAuth2Error.clientInvalid();
 		if (!client.active) throw OAuth2Error.clientInactive();
+		if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) throw OAuth2Error.requestInvalid("PKCE code_challenge is required for public clients.");
+		if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) throw OAuth2Error.requestInvalid("state is required for public clients in the code flow.");
 		data.client_id = client.id;
 		data.realm_id = client.realm_id;
 		const scopes = await this.scopeRepository.findByClientId(client.id);

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ScopeName","isSimpleMatch","OAuth2Error","hasOAuth2Scopes","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","clientInvalid","client","findOneByIdOrName","realm_id","active","clientInactive","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","scopeInsufficient","join","redirect_uri","redirectUris","split","redirectUriMismatch"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { isSimpleMatch } from '@authup/kit';\nimport { OAuth2Error, hasOAuth2Scopes } from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2Error.clientInactive();\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realm_id;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2Error.scopeInsufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        if (client.redirect_uri && data.redirect_uri) {\n            const redirectUris = client.redirect_uri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2Error.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n        };\n    }\n}\n"],"mappings":";;;;AAmBA,IAAaI,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;AAC5D,OAAKF,mBAAmBE,IAAIF;AAC5B,OAAKC,kBAAkBC,IAAID;;;;;IAO/B,MAAME,OACFC,MAC0D;AAC1D,MAAI,CAACA,KAAKC,UACN,OAAMR,YAAYS,eAAa;EAGnC,MAAMC,SAAS,MAAM,KAAKP,iBAAiBQ,kBAAkBJ,KAAKC,WAAWD,KAAKK,SAAQ;AAC1F,MAAI,CAACF,OACD,OAAMV,YAAYS,eAAa;AAGnC,MAAI,CAACC,OAAOG,OACR,OAAMb,YAAYc,gBAAc;AAGpCP,OAAKC,YAAYE,OAAOK;AACxBR,OAAKK,WAAWF,OAAOE;EAEvB,MAAMI,SAAS,MAAM,KAAKZ,gBAAgBa,eAAeP,OAAOK,GAAE;EAClE,MAAMG,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,KAAI;AACnD,MAAId,KAAKa;OAED,CAACnB,gBAAgBiB,YAAYX,KAAKa,MAAK,IACvC,CAACnB,gBAAgBM,KAAKa,OAAOtB,UAAUwB,OAAM,CAE7C,OAAMtB,YAAYuB,mBAAiB;QAGvChB,MAAKa,QAAQF,WAAWM,KAAK,IAAA;AAGjC,MAAId,OAAOe,gBAAgBlB,KAAKkB,cAAc;GAC1C,MAAMC,eAAehB,OAAOe,aAAaE,MAAM,IAAA;AAE/C,OAAI,CAAC5B,cAAcQ,KAAKkB,cAAcC,aAAAA,CAClC,OAAM1B,YAAY4B,qBAAmB;;AAI7C,SAAO;GACHrB;GACAG;GACAM;GACJ"}
+{"version":3,"file":"module.mjs","names":["ScopeName","isSimpleMatch","OAuth2AuthorizationResponseType","OAuth2Error","hasOAuth2Scopes","willIssueCode","responseType","split","includes","CODE","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","clientInvalid","client","findOneByIdOrName","realm_id","active","clientInactive","is_confidential","code_challenge","response_type","requestInvalid","state","id","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","scopeInsufficient","join","redirect_uri","redirectUris","redirectUriMismatch"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { isSimpleMatch } from '@authup/kit';\nimport {\n    OAuth2AuthorizationResponseType,\n    OAuth2Error,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nfunction willIssueCode(responseType: string | undefined): boolean {\n    if (!responseType) {\n        return false;\n    }\n    return responseType.split(' ').includes(OAuth2AuthorizationResponseType.CODE);\n}\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2Error.clientInactive();\n        }\n\n        // Public clients MUST use PKCE for the code flow (RFC 7636 §4.4.1,\n        // OAuth 2.1). Without PKCE a public client's code flow has no second\n        // factor — anyone who intercepts the redirect can redeem the code at\n        // /token. Only enforce when an authorization code will actually be\n        // issued; implicit/id_token-only flows don't involve a code.\n        if (!client.is_confidential && !data.code_challenge && willIssueCode(data.response_type)) {\n            throw OAuth2Error.requestInvalid('PKCE code_challenge is required for public clients.');\n        }\n\n        // Public clients SHOULD include state to bind the redirect to the\n        // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n        // clients are exempt because the /token exchange already authenticates\n        // them via client_secret.\n        if (!client.is_confidential && !data.state && willIssueCode(data.response_type)) {\n            throw OAuth2Error.requestInvalid('state is required for public clients in the code flow.');\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realm_id;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2Error.scopeInsufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        if (client.redirect_uri && data.redirect_uri) {\n            const redirectUris = client.redirect_uri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2Error.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n        };\n    }\n}\n"],"mappings":";;;;AAuBA,SAASK,cAAcC,cAAgC;AACnD,KAAI,CAACA,aACD,QAAO;AAEX,QAAOA,aAAaC,MAAM,IAAA,CAAKC,SAASN,gCAAgCO,KAAI;;AAGhF,IAAaC,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;AAC5D,OAAKF,mBAAmBE,IAAIF;AAC5B,OAAKC,kBAAkBC,IAAID;;;;;IAO/B,MAAME,OACFC,MAC0D;AAC1D,MAAI,CAACA,KAAKC,UACN,OAAMb,YAAYc,eAAa;EAGnC,MAAMC,SAAS,MAAM,KAAKP,iBAAiBQ,kBAAkBJ,KAAKC,WAAWD,KAAKK,SAAQ;AAC1F,MAAI,CAACF,OACD,OAAMf,YAAYc,eAAa;AAGnC,MAAI,CAACC,OAAOG,OACR,OAAMlB,YAAYmB,gBAAc;AAQpC,MAAI,CAACJ,OAAOK,mBAAmB,CAACR,KAAKS,kBAAkBnB,cAAcU,KAAKU,cAAa,CACnF,OAAMtB,YAAYuB,eAAe,sDAAA;AAOrC,MAAI,CAACR,OAAOK,mBAAmB,CAACR,KAAKY,SAAStB,cAAcU,KAAKU,cAAa,CAC1E,OAAMtB,YAAYuB,eAAe,yDAAA;AAGrCX,OAAKC,YAAYE,OAAOU;AACxBb,OAAKK,WAAWF,OAAOE;EAEvB,MAAMS,SAAS,MAAM,KAAKjB,gBAAgBkB,eAAeZ,OAAOU,GAAE;EAClE,MAAMG,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,KAAI;AACnD,MAAInB,KAAKkB;OAED,CAAC7B,gBAAgB2B,YAAYhB,KAAKkB,MAAK,IACvC,CAAC7B,gBAAgBW,KAAKkB,OAAOjC,UAAUmC,OAAM,CAE7C,OAAMhC,YAAYiC,mBAAiB;QAGvCrB,MAAKkB,QAAQF,WAAWM,KAAK,IAAA;AAGjC,MAAInB,OAAOoB,gBAAgBvB,KAAKuB,cAAc;GAC1C,MAAMC,eAAerB,OAAOoB,aAAa/B,MAAM,IAAA;AAE/C,OAAI,CAACN,cAAcc,KAAKuB,cAAcC,aAAAA,CAClC,OAAMpC,YAAYqC,qBAAmB;;AAI7C,SAAO;GACHzB;GACAG;GACAW;GACJ"}

package/dist/core/oauth2/client/authenticator.d.ts

@@ -0,0 +1,17 @@
+import type { Client } from '@authup/core-kit';
+import { ClientCredentialsService } from '../../authentication/credential/index.ts';
+import type { IIdentityResolver } from '../../identity/index.ts';
+/**
+ * Authenticates a client at the OAuth2 token endpoint. Confidential clients
+ * MUST present a valid client_secret (RFC 6749 §3.2.1, §4.1.3, §4.3.2, §6);
+ * public clients identify via client_id only.
+ *
+ * Used by authorization_code, refresh_token, and password grants.
+ */
+export declare class OAuth2ClientAuthenticator {
+    protected identityResolver: IIdentityResolver;
+    protected credentialsService: ClientCredentialsService;
+    constructor(identityResolver: IIdentityResolver);
+    authenticate(clientId: string | undefined, clientSecret?: string, realmId?: string): Promise<Client>;
+}
+//# sourceMappingURL=authenticator.d.ts.map

package/dist/core/oauth2/client/authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/authenticator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE;;;;;;GAMG;AACH,qBAAa,yBAAyB;IAClC,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;gBAE3C,gBAAgB,EAAE,iBAAiB;IAKzC,YAAY,CACd,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;CA2BrB"}

package/dist/core/oauth2/client/authenticator.mjs

@@ -0,0 +1,34 @@
+import { ClientCredentialsService } from "../../authentication/credential/entities/client/module.mjs";
+import "../../authentication/credential/index.mjs";
+import { IdentityType } from "@authup/core-kit";
+import { OAuth2Error } from "@authup/specs";
+//#region src/core/oauth2/client/authenticator.ts
+/**
+* Authenticates a client at the OAuth2 token endpoint. Confidential clients
+* MUST present a valid client_secret (RFC 6749 §3.2.1, §4.1.3, §4.3.2, §6);
+* public clients identify via client_id only.
+*
+* Used by authorization_code, refresh_token, and password grants.
+*/ var OAuth2ClientAuthenticator = class {
+	identityResolver;
+	credentialsService;
+	constructor(identityResolver) {
+		this.identityResolver = identityResolver;
+		this.credentialsService = new ClientCredentialsService();
+	}
+	async authenticate(clientId, clientSecret, realmId) {
+		if (!clientId) throw OAuth2Error.clientInvalid();
+		const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);
+		if (!identity || identity.type !== IdentityType.CLIENT) throw OAuth2Error.clientInvalid();
+		if (!identity.data.active) throw OAuth2Error.clientInactive();
+		if (identity.data.is_confidential) {
+			if (!clientSecret) throw OAuth2Error.clientInvalid();
+			if (!await this.credentialsService.verify(clientSecret, identity.data)) throw OAuth2Error.clientInvalid();
+		}
+		return identity.data;
+	}
+};
+//#endregion
+export { OAuth2ClientAuthenticator };
+
+//# sourceMappingURL=authenticator.mjs.map

package/dist/core/oauth2/client/authenticator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.mjs","names":["IdentityType","OAuth2Error","ClientCredentialsService","OAuth2ClientAuthenticator","identityResolver","credentialsService","authenticate","clientId","clientSecret","realmId","clientInvalid","identity","resolve","CLIENT","type","data","active","clientInactive","is_confidential","verified","verify"],"sources":["../../../../src/core/oauth2/client/authenticator.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { OAuth2Error } from '@authup/specs';\nimport { ClientCredentialsService } from '../../authentication/credential/index.ts';\nimport type { IIdentityResolver } from '../../identity/index.ts';\n\n/**\n * Authenticates a client at the OAuth2 token endpoint. Confidential clients\n * MUST present a valid client_secret (RFC 6749 §3.2.1, §4.1.3, §4.3.2, §6);\n * public clients identify via client_id only.\n *\n * Used by authorization_code, refresh_token, and password grants.\n */\nexport class OAuth2ClientAuthenticator {\n    protected identityResolver: IIdentityResolver;\n\n    protected credentialsService: ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(\n        clientId: string | undefined,\n        clientSecret?: string,\n        realmId?: string,\n    ): Promise<Client> {\n        if (!clientId) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, clientId, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw OAuth2Error.clientInvalid();\n        }\n\n        if (!identity.data.active) {\n            throw OAuth2Error.clientInactive();\n        }\n\n        if (identity.data.is_confidential) {\n            if (!clientSecret) {\n                throw OAuth2Error.clientInvalid();\n            }\n\n            const verified = await this.credentialsService.verify(clientSecret, identity.data);\n            if (!verified) {\n                throw OAuth2Error.clientInvalid();\n            }\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;;;;;;;GAoBA,IAAaG,4BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,kBAAqC;AAC7C,OAAKA,mBAAmBA;AACxB,OAAKC,qBAAqB,IAAIH,0BAAAA;;CAGlC,MAAMI,aACFC,UACAC,cACAC,SACe;AACf,MAAI,CAACF,SACD,OAAMN,YAAYS,eAAa;EAGnC,MAAMC,WAAW,MAAM,KAAKP,iBAAiBQ,QAAQZ,aAAaa,QAAQN,UAAUE,QAAAA;AACpF,MAAI,CAACE,YAAYA,SAASG,SAASd,aAAaa,OAC5C,OAAMZ,YAAYS,eAAa;AAGnC,MAAI,CAACC,SAASI,KAAKC,OACf,OAAMf,YAAYgB,gBAAc;AAGpC,MAAIN,SAASI,KAAKG,iBAAiB;AAC/B,OAAI,CAACV,aACD,OAAMP,YAAYS,eAAa;AAInC,OAAI,CAACS,MADkB,KAAKd,mBAAmBe,OAAOZ,cAAcG,SAASI,KAAI,CAE7E,OAAMd,YAAYS,eAAa;;AAIvC,SAAOC,SAASI"}

package/dist/core/oauth2/client/index.d.ts

@@ -1,2 +1,3 @@
+export * from './authenticator.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/client/index.mjs

@@ -1 +1,2 @@
-export {};
+import { OAuth2ClientAuthenticator } from "./authenticator.mjs";
+export { OAuth2ClientAuthenticator };

package/dist/core/oauth2/grant-types/password.d.ts

@@ -1,11 +1,15 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
-import type { User } from '@authup/core-kit';
+import type { Client, User } from '@authup/core-kit';
 import type { IOAuth2TokenIssuer } from '../token/index.ts';
 import { OAuth2BaseGrant } from './base.ts';
 import type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';
-export declare class PasswordGrantType extends OAuth2BaseGrant<User> {
+export type OAuth2PasswordGrantInput = {
+    user: User;
+    client?: Client;
+};
+export declare class PasswordGrantType extends OAuth2BaseGrant<OAuth2PasswordGrantInput> {
     protected refreshTokenIssuer: IOAuth2TokenIssuer;
     constructor(ctx: OAuth2PasswordGrantContext);
-    runWith(input: User, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;
+    runWith(input: OAuth2PasswordGrantInput, options?: OAuth2GrantRunWIthOptions): Promise<OAuth2TokenGrantResponse>;
 }
 //# sourceMappingURL=password.d.ts.map

package/dist/core/oauth2/grant-types/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAM7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExF,qBAAa,iBAAkB,SAAQ,eAAe,CAAC,IAAI,CAAC;IACxD,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;gBAEtC,GAAG,EAAE,0BAA0B;IASrC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,GAAE,yBAA8B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAgC1G"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAElF,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAMrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,eAAe,CAAC,wBAAwB,CAAC;IAC5E,SAAS,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;gBAEtC,GAAG,EAAE,0BAA0B;IASrC,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,OAAO,GAAE,yBAA8B,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAmC9H"}

package/dist/core/oauth2/grant-types/password.mjs

@@ -13,24 +13,26 @@ var PasswordGrantType = class extends OAuth2BaseGrant {
 		this.refreshTokenIssuer = ctx.refreshTokenIssuer;
 	}
 	async runWith(input, options = {}) {
+		const { user, client } = input;
+		const clientId = client?.id;
 		const session = await this.sessionManager.create({
 			user_agent: options.userAgent,
 			ip_address: options.ipAddress,
-			realm_id: input.realm_id,
-			client_id: input.client_id || void 0,
-			sub: input.id,
+			realm_id: user.realm_id,
+			client_id: clientId,
+			sub: user.id,
 			sub_kind: IdentityType.USER
 		});
 		const issuePayload = {
-			client_id: input.client_id || void 0,
+			client_id: clientId,
 			session_id: session.id,
 			user_agent: session.user_agent,
 			remote_address: session.ip_address,
 			scope: ScopeName.GLOBAL,
-			sub: input.id,
+			sub: user.id,
 			sub_kind: OAuth2SubKind.USER,
-			realm_id: input.realm_id,
-			realm_name: input.realm?.name
+			realm_id: user.realm_id,
+			realm_name: user.realm?.name
 		};
 		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);
 		const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);

package/dist/core/oauth2/grant-types/password.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","PasswordGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","input","options","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","undefined","sub","id","sub_kind","USER","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';\n\nexport class PasswordGrantType extends OAuth2BaseGrant<User> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2PasswordGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(input: User, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            client_id: input.client_id || undefined,\n            sub: input.id,\n            sub_kind: IdentityType.USER,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: input.client_id || undefined,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: input.realm_id,\n            realm_name: input.realm?.name,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAmBA,IAAaK,oBAAb,cAAuCD,gBAAAA;CACzBE;CAEV,YAAYC,KAAiC;AACzC,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QAAQC,OAAaC,UAAqC,EAAE,EAAsC;EACpG,MAAMC,UAAU,MAAM,KAAKJ,eAAeK,OAAO;GAC7CC,YAAYH,QAAQI;GACpBC,YAAYL,QAAQM;GACpBC,UAAUR,MAAMQ;GAChBC,WAAWT,MAAMS,aAAaC,KAAAA;GAC9BC,KAAKX,MAAMY;GACXC,UAAUvB,aAAawB;GAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CN,WAAWT,MAAMS,aAAaC,KAAAA;GAC9BM,YAAYd,QAAQU;GACpBR,YAAYF,QAAQE;GACpBa,gBAAgBf,QAAQI;GACxBY,OAAO3B,UAAU4B;GACjBR,KAAKX,MAAMY;GACXC,UAAUxB,cAAcyB;GACxBN,UAAUR,MAAMQ;GAChBY,YAAYpB,MAAMqB,OAAOC;GAC7B;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAK3B,kBAAkB4B,MAAMV,aAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKhC,mBAAmB8B,MAAMV,aAAAA;AAEhF,SAAOvB,+BAA+B;GAClC+B;GACAC;GACAE;GACAC;GACJ,CAAA"}
+{"version":3,"file":"password.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","PasswordGrantType","refreshTokenIssuer","ctx","accessTokenIssuer","sessionManager","runWith","input","options","user","client","clientId","id","session","create","user_agent","userAgent","ip_address","ipAddress","realm_id","client_id","sub","sub_kind","USER","issuePayload","session_id","remote_address","scope","GLOBAL","realm_name","realm","name","accessToken","accessTokenPayload","issue","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { OAuth2GrantRunWIthOptions, OAuth2PasswordGrantContext } from './types.ts';\n\nexport type OAuth2PasswordGrantInput = {\n    user: User,\n    client?: Client,\n};\n\nexport class PasswordGrantType extends OAuth2BaseGrant<OAuth2PasswordGrantInput> {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    constructor(ctx: OAuth2PasswordGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n    }\n\n    async runWith(input: OAuth2PasswordGrantInput, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const { user, client } = input;\n        const clientId = client?.id;\n\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: user.realm_id,\n            client_id: clientId,\n            sub: user.id,\n            sub_kind: IdentityType.USER,\n        });\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realm_id,\n            realm_name: user.realm?.name,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAwBA,IAAaK,oBAAb,cAAuCD,gBAAAA;CACzBE;CAEV,YAAYC,KAAiC;AACzC,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKH,qBAAqBC,IAAID;;CAGlC,MAAMI,QAAQC,OAAiCC,UAAqC,EAAE,EAAsC;EACxH,MAAM,EAAEC,MAAMC,WAAWH;EACzB,MAAMI,WAAWD,QAAQE;EAEzB,MAAMC,UAAU,MAAM,KAAKR,eAAeS,OAAO;GAC7CC,YAAYP,QAAQQ;GACpBC,YAAYT,QAAQU;GACpBC,UAAUV,KAAKU;GACfC,WAAWT;GACXU,KAAKZ,KAAKG;GACVU,UAAUzB,aAAa0B;GAC3B,CAAA;EAEA,MAAMC,eAA6C;GAC/CJ,WAAWT;GACXc,YAAYZ,QAAQD;GACpBG,YAAYF,QAAQE;GACpBW,gBAAgBb,QAAQI;GACxBU,OAAO7B,UAAU8B;GACjBP,KAAKZ,KAAKG;GACVU,UAAU1B,cAAc2B;GACxBJ,UAAUV,KAAKU;GACfU,YAAYpB,KAAKqB,OAAOC;GAC5B;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAK7B,kBAAkB8B,MAAMV,aAAAA;EAC7E,MAAM,CAACW,cAAcC,uBAAuB,MAAM,KAAKlC,mBAAmBgC,MAAMV,aAAAA;AAEhF,SAAOzB,+BAA+B;GAClCiC;GACAC;GACAE;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/index.mjs

@@ -6,6 +6,8 @@ import { OAuth2AuthorizationCodeRequestValidator } from "./authorization/code-re
 import { OAuth2AuthorizationStateManager } from "./authorization/state/module.mjs";
 import { OAuth2Authorization } from "./authorization/module.mjs";
 import "./authorization/index.mjs";
+import { OAuth2ClientAuthenticator } from "./client/authenticator.mjs";
+import "./client/index.mjs";
 import { buildOAuth2BearerTokenResponse } from "./response/bearer.mjs";
 import { OAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
 import { ClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
@@ -25,4 +27,4 @@ import { OAuth2TokenRevoker } from "./token/revoker/module.mjs";
 import { OAuth2TokenSigner } from "./token/signer/module.mjs";
 import { OAuth2TokenVerifier } from "./token/verifier/module.mjs";
 import "./token/index.mjs";
-export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, RobotCredentialsGrant, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };
+export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, RobotCredentialsGrant, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };

package/dist/core/oauth2/token/issuer/access/module.d.ts

@@ -3,10 +3,13 @@ import type { IOAuth2TokenSigner } from '../../signer/index.ts';
 import type { IOAuth2TokenRepository } from '../../repository/index.ts';
 import { OAuth2BaseTokenIssuer } from '../base.ts';
 import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';
+import type { IIdentityRoleProvider } from '../../../../identity/index.ts';
 export declare class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {
     protected repository: IOAuth2TokenRepository;
     protected signer: IOAuth2TokenSigner;
-    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions);
+    protected identityRoleProvider?: IIdentityRoleProvider;
+    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions, identityRoleProvider?: IIdentityRoleProvider);
     issue(input?: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
+    protected buildAccessClaims(input: OAuth2TokenPayload): Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/issuer/access/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3G,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;gBAGlC,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B;IAQpC,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;CAgBnF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;gBAGnD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,oBAAoB,CAAC,EAAE,qBAAqB;IAS1C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;cAoBhE,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,eAAe,CAAC,CAAC;CA6BrI"}

package/dist/core/oauth2/token/issuer/access/module.mjs

@@ -4,23 +4,45 @@ import { OAuth2TokenKind } from "@authup/specs";
 var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
 	repository;
 	signer;
-	constructor(repository, signer, options = {}) {
+	identityRoleProvider;
+	constructor(repository, signer, options = {}, identityRoleProvider) {
 		super(options);
 		this.repository = repository;
 		this.signer = signer;
+		this.identityRoleProvider = identityRoleProvider;
 	}
 	async issue(input = {}) {
 		const iss = this.buildIss(input);
+		const accessClaims = await this.buildAccessClaims(input);
 		const data = await this.repository.insert({
 			...input,
 			kind: OAuth2TokenKind.ACCESS,
 			exp: this.buildExp(input),
-			...iss ? { iss } : {}
+			...iss ? { iss } : {},
+			...accessClaims
 		});
 		const token = await this.signer.sign(data);
 		await this.repository.saveWithSignature(data, token);
 		return [token, data];
 	}
+	async buildAccessClaims(input) {
+		if (!this.identityRoleProvider || !input.sub || !input.sub_kind) return {};
+		const roles = await this.identityRoleProvider.getRolesFor({
+			type: input.sub_kind,
+			id: input.sub,
+			clientId: input.client_id,
+			realmId: input.realm_id,
+			realmName: input.realm_name
+		});
+		const realmRoles = [];
+		const globalRoles = [];
+		for (const role of roles) if (!role.realm_id) globalRoles.push(role.name);
+		else if (input.realm_id && role.realm_id === input.realm_id) realmRoles.push(role.name);
+		return {
+			realm_access: { roles: realmRoles },
+			global_access: { roles: globalRoles }
+		};
+	}
 };
 //#endregion
 export { OAuth2AccessTokenIssuer };

package/dist/core/oauth2/token/issuer/access/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","options","issue","input","iss","buildIss","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;AAcA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEV,YACID,YACAC,QACAC,UAAoC,EAAE,EACxC;AACE,QAAMA,QAAAA;AAEN,OAAKF,aAAaA;AAClB,OAAKC,SAASA;;CAGlB,MAAME,MAAMC,QAA4B,EAAE,EAAuC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,MAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKP,WAAWQ,OAAO;GACtC,GAAGJ;GACHK,MAAMZ,gBAAgBa;GACtBC,KAAK,KAAKC,SAASR,MAAAA;GACnB,GAAIC,MAAM,EAAEA,KAAI,GAAI,EAAE;GAC1B,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKZ,OAAOa,KAAKP,KAAAA;AAErC,QAAM,KAAKP,WAAWe,kBAAkBR,MAAMM,MAAAA;AAE9C,SAAO,CAACA,OAAON,KAAK"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","sub","sub_kind","roles","getRolesFor","type","id","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realm_id) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realm_id === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;AAeA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,EAAE,EACtCD,sBACF;AACE,QAAMC,QAAAA;AAEN,OAAKH,aAAaA;AAClB,OAAKC,SAASA;AACd,OAAKC,uBAAuBA;;CAGhC,MAAME,MAAMC,QAA4B,EAAE,EAAuC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,MAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,MAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKV,WAAWW,OAAO;GACtC,GAAGN;GACHO,MAAMf,gBAAgBgB;GACtBC,KAAK,KAAKC,SAASV,MAAAA;GACnB,GAAIC,MAAM,EAAEA,KAAI,GAAI,EAAE;GACtB,GAAGE;GACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKf,OAAOgB,KAAKP,KAAAA;AAErC,QAAM,KAAKV,WAAWkB,kBAAkBR,MAAMM,MAAAA;AAE9C,SAAO,CAACA,OAAON,KAAK;;CAGxB,MAAgBD,kBAAkBJ,OAAiG;AAC/H,MAAI,CAAC,KAAKH,wBAAwB,CAACG,MAAMc,OAAO,CAACd,MAAMe,SACnD,QAAO,EAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAKnB,qBAAqBoB,YAAY;GACtDC,MAAMlB,MAAMe;GACZI,IAAInB,MAAMc;GACVM,UAAUpB,MAAMqB;GAChBC,SAAStB,MAAMuB;GACfC,WAAWxB,MAAMyB;GACrB,CAAA;EAEA,MAAMC,aAAuB,EAAE;EAC/B,MAAMC,cAAwB,EAAE;AAEhC,OAAK,MAAMC,QAAQZ,MACf,KAAI,CAACY,KAAKL,SACNI,aAAYE,KAAKD,KAAKE,KAAI;WACnB9B,MAAMuB,YAAYK,KAAKL,aAAavB,MAAMuB,SACjDG,YAAWG,KAAKD,KAAKE,KAAI;AAIjC,SAAO;GACHC,cAAc,EAAEf,OAAOU,YAAW;GAClCM,eAAe,EAAEhB,OAAOW,aAAY;GACxC"}

package/dist/core/oauth2/token/issuer/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE1G,8BAAsB,qBAAsB,YAAW,kBAAkB;IACrE,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAI5C,SAAS,aAAa,OAAO,CAAC,EAAE,wBAAwB;IAMxD,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIjH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM,GAAG,SAAS;IAY7D;;;;OAIG;IACH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM;CAYpD"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE1G,8BAAsB,qBAAsB,YAAW,kBAAkB;IACrE,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAI5C,SAAS,aAAa,OAAO,CAAC,EAAE,wBAAwB;IAMxD,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIjH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM,GAAG,SAAS;IAiB7D;;;;OAIG;IACH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM;CAYpD"}

package/dist/core/oauth2/token/issuer/base.mjs

@@ -6,8 +6,9 @@ var OAuth2BaseTokenIssuer = class {
 	}
 	buildIss(input = {}) {
 		if (!this.options.issuer) return;
-		if (input.realm_name) return `${this.options.issuer}/realms/${input.realm_name}`;
-		return this.options.issuer;
+		const base = this.options.issuer.replace(/\/+$/, "");
+		if (input.realm_name) return `${base}/realms/${input.realm_name}`;
+		return base;
 	}
 	/**
 	* Build utc expire time (in seconds).

package/dist/core/oauth2/token/issuer/base.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"base.mjs","names":["OAuth2BaseTokenIssuer","options","buildIss","input","issuer","undefined","realm_name","buildExp","exp","utc","Math","floor","Date","getTime","maxAge"],"sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from './types.ts';\n\nexport abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected options: OAuth2TokenIssuerOptions;\n\n    // ------------------------------------------------------------------\n\n    protected constructor(options?: OAuth2TokenIssuerOptions) {\n        this.options = options || {};\n    }\n\n    // ------------------------------------------------------------------\n\n    abstract issue(input: OAuth2TokenPayload, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;\n\n    // ------------------------------------------------------------------\n\n    buildIss(input: OAuth2TokenPayload = {}) : string | undefined {\n        if (!this.options.issuer) {\n            return undefined;\n        }\n\n        if (input.realm_name) {\n            return `${this.options.issuer}/realms/${input.realm_name}`;\n        }\n\n        return this.options.issuer;\n    }\n\n    /**\n     * Build utc expire time (in seconds).\n     *\n     * @param input\n     */\n    buildExp(input: OAuth2TokenPayload = {}) : number {\n        if (input.exp) {\n            return input.exp;\n        }\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n        if (this.options.maxAge) {\n            return utc + this.options.maxAge;\n        }\n\n        return utc + 3_600;\n    }\n}\n"],"mappings":";AAUA,IAAsBA,wBAAtB,MAAsBA;CACRC;CAIV,YAAsBA,SAAoC;AACtD,OAAKA,UAAUA,WAAW,EAAC;;CAS/BC,SAASC,QAA4B,EAAE,EAAuB;AAC1D,MAAI,CAAC,KAAKF,QAAQG,OACd;AAGJ,MAAID,MAAMG,WACN,QAAO,GAAG,KAAKL,QAAQG,OAAO,UAAUD,MAAMG;AAGlD,SAAO,KAAKL,QAAQG;;;;;;IAQxBG,SAASJ,QAA4B,EAAE,EAAW;AAC9C,MAAIA,MAAMK,IACN,QAAOL,MAAMK;EAGjB,MAAMC,MAAMC,KAAKC,uBAAM,IAAIC,MAAAA,EAAOC,SAAO,GAAK,IAAA;AAC9C,MAAI,KAAKZ,QAAQa,OACb,QAAOL,MAAM,KAAKR,QAAQa;AAG9B,SAAOL,MAAM"}
+{"version":3,"file":"base.mjs","names":["OAuth2BaseTokenIssuer","options","buildIss","input","issuer","undefined","base","replace","realm_name","buildExp","exp","utc","Math","floor","Date","getTime","maxAge"],"sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from './types.ts';\n\nexport abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected options: OAuth2TokenIssuerOptions;\n\n    // ------------------------------------------------------------------\n\n    protected constructor(options?: OAuth2TokenIssuerOptions) {\n        this.options = options || {};\n    }\n\n    // ------------------------------------------------------------------\n\n    abstract issue(input: OAuth2TokenPayload, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;\n\n    // ------------------------------------------------------------------\n\n    buildIss(input: OAuth2TokenPayload = {}) : string | undefined {\n        if (!this.options.issuer) {\n            return undefined;\n        }\n\n        // Strip a trailing slash so a configured issuer like\n        // `https://auth.example.com/` doesn't produce a malformed\n        // `https://auth.example.com//realms/master`.\n        const base = this.options.issuer.replace(/\\/+$/, '');\n\n        if (input.realm_name) {\n            return `${base}/realms/${input.realm_name}`;\n        }\n\n        return base;\n    }\n\n    /**\n     * Build utc expire time (in seconds).\n     *\n     * @param input\n     */\n    buildExp(input: OAuth2TokenPayload = {}) : number {\n        if (input.exp) {\n            return input.exp;\n        }\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n        if (this.options.maxAge) {\n            return utc + this.options.maxAge;\n        }\n\n        return utc + 3_600;\n    }\n}\n"],"mappings":";AAUA,IAAsBA,wBAAtB,MAAsBA;CACRC;CAIV,YAAsBA,SAAoC;AACtD,OAAKA,UAAUA,WAAW,EAAC;;CAS/BC,SAASC,QAA4B,EAAE,EAAuB;AAC1D,MAAI,CAAC,KAAKF,QAAQG,OACd;EAMJ,MAAME,OAAO,KAAKL,QAAQG,OAAOG,QAAQ,QAAQ,GAAA;AAEjD,MAAIJ,MAAMK,WACN,QAAO,GAAGF,KAAK,UAAUH,MAAMK;AAGnC,SAAOF;;;;;;IAQXG,SAASN,QAA4B,EAAE,EAAW;AAC9C,MAAIA,MAAMO,IACN,QAAOP,MAAMO;EAGjB,MAAMC,MAAMC,KAAKC,uBAAM,IAAIC,MAAAA,EAAOC,SAAO,GAAK,IAAA;AAC9C,MAAI,KAAKd,QAAQe,OACb,QAAOL,MAAM,KAAKV,QAAQe;AAG9B,SAAOL,MAAM"}

package/dist/core/provisioning/entities/permission/types.d.ts

@@ -1,6 +1,14 @@
 import type { Permission } from '@authup/core-kit';
 import type { BaseProvisioningEntity } from '../types.ts';
+export type PermissionProvisioningRelations = {
+    /**
+     * Policy names to attach to this permission via auth_permission_policies.
+     * Resolved to IDs and inserted as junction rows during provisioning.
+     */
+    policies?: string[];
+};
 export type PermissionProvisioningEntity = BaseProvisioningEntity<Permission> & {
     attributes: Partial<Permission>;
+    relations?: PermissionProvisioningRelations;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/entities/permission/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/permission/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,MAAM,4BAA4B,GAAG,sBAAsB,CAAC,UAAU,CAAC,GAAG;IAC5E,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;CAClC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/permission/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,MAAM,+BAA+B,GAAG;IAC1C;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,sBAAsB,CAAC,UAAU,CAAC,GAAG;IAC5E,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,+BAA+B,CAAC;CAC/C,CAAC"}

package/dist/core/provisioning/synchronizer/permission/module.d.ts

@@ -1,10 +1,14 @@
-import type { IPermissionRepository } from '../../../entities/index.ts';
+import type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';
+import type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';
 import type { PermissionProvisioningEntity } from '../../entities/permission';
 import { BaseProvisioningSynchronizer } from '../base.ts';
 import type { PermissionProvisioningSynchronizerContext } from './types.ts';
 export declare class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {
     protected repository: IPermissionRepository;
+    protected policyRepository?: IPolicyRepository;
+    protected permissionPolicyRepository?: IPermissionPolicyRepository;
     constructor(ctx: PermissionProvisioningSynchronizerContext);
     synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity>;
+    private synchronizePolicies;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/synchronizer/permission/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,YAAY,CAAC;AAE5E,qBAAa,kCAAmC,SAAQ,4BAA4B,CAAC,4BAA4B,CAAC;IAC9G,SAAS,CAAC,UAAU,EAAG,qBAAqB,CAAC;gBAEjC,GAAG,EAAE,yCAAyC;IAMpD,WAAW,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,4BAA4B,CAAC;CA6ChG"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,YAAY,CAAC;AAE5E,qBAAa,kCAAmC,SAAQ,4BAA4B,CAAC,4BAA4B,CAAC;IAC9G,SAAS,CAAC,UAAU,EAAG,qBAAqB,CAAC;IAE7C,SAAS,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,CAAC,EAAE,2BAA2B,CAAC;gBAEvD,GAAG,EAAE,yCAAyC;IAQpD,WAAW,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,4BAA4B,CAAC;YAkD/E,mBAAmB;CAgCpC"}

package/dist/core/provisioning/synchronizer/permission/module.mjs

@@ -6,9 +6,13 @@ import { pickRecord } from "@authup/kit";
 //#region src/core/provisioning/synchronizer/permission/module.ts
 var PermissionProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 	repository;
+	policyRepository;
+	permissionPolicyRepository;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
+		this.policyRepository = ctx.policyRepository;
+		this.permissionPolicyRepository = ctx.permissionPolicyRepository;
 	}
 	async synchronize(input) {
 		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
@@ -35,11 +39,30 @@ var PermissionProvisioningSynchronizer = class extends BaseProvisioningSynchroni
 				break;
 		}
 		else attributes = await this.repository.save(this.repository.create(input.attributes));
+		if (input.relations?.policies && input.relations.policies.length > 0) await this.synchronizePolicies(attributes, input.relations.policies);
 		return {
 			...input,
 			attributes
 		};
 	}
+	async synchronizePolicies(permission, policyNames) {
+		if (!this.policyRepository || !this.permissionPolicyRepository) throw new Error("Provisioning: policy/permissionPolicy repositories must be wired to attach policies to permissions.");
+		for (const policyName of policyNames) {
+			const policy = await this.policyRepository.findOneByName(policyName);
+			if (!policy) throw new Error(`Provisioning: policy '${policyName}' not found for permission '${permission.name}'.`);
+			if (await this.permissionPolicyRepository.findOneBy({
+				permission_id: permission.id,
+				policy_id: policy.id
+			})) continue;
+			const entry = this.permissionPolicyRepository.create({
+				permission_id: permission.id,
+				permission_realm_id: permission.realm_id,
+				policy_id: policy.id,
+				policy_realm_id: policy.realm_id
+			});
+			await this.permissionPolicyRepository.save(entry);
+		}
+	}
 };
 //#endregion
 export { PermissionProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","PermissionProvisioningSynchronizer","repository","ctx","synchronize","input","strategy","attributes","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IPermissionRepository } from '../../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PermissionProvisioningSynchronizerContext } from './types.ts';\n\nexport class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {\n    protected repository : IPermissionRepository;\n\n    constructor(ctx: PermissionProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n    }\n\n    async synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n            client_id: input.attributes.client_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaI,qCAAb,cAAwDD,6BAAAA;CAC1CE;CAEV,YAAYC,KAAgD;AACxD,SAAK;AAEL,OAAKD,aAAaC,IAAID;;CAG1B,MAAME,YAAYC,OAA4E;EAC1F,MAAMC,WAAWP,oCAAoCM,MAAMC,SAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKL,WAAWM,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GACvCC,WAAWN,MAAME,WAAWI,aAAa;GAC7C,CAAA;AAEA,MAAIL,SAASM,SAASd,+BAA+Be,QAAQ;AACzD,OAAIN,WACA,OAAM,KAAKL,WAAWY,OAAOP,WAAAA;AAEjC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASM,MAAjB;GACI,KAAKd,+BAA+BiB;AAChCR,iBAAa,KAAKL,WAAWc,MACzBT,YACAD,SAASC,aACLV,WAAWQ,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKL,WAAWe,KAAKV,WAAAA;AACxC;GACJ,KAAKT,+BAA+BoB;AAChCb,UAAME,WAAWY,KAAKZ,WAAWY;AACjCZ,iBAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,WAAU,CAAA;AAC/E;;MAGRA,cAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,WAAU,CAAA;AAGnF,SAAO;GACH,GAAGF;GACHE;GACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","PermissionProvisioningSynchronizer","repository","policyRepository","permissionPolicyRepository","ctx","synchronize","input","strategy","attributes","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","policies","length","synchronizePolicies","permission","policyNames","Error","policyName","policy","findOneByName","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id"],"sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PermissionProvisioningSynchronizerContext } from './types.ts';\n\nexport class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {\n    protected repository : IPermissionRepository;\n\n    protected policyRepository?: IPolicyRepository;\n\n    protected permissionPolicyRepository?: IPermissionPolicyRepository;\n\n    constructor(ctx: PermissionProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n            client_id: input.attributes.client_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes,\n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations?.policies && input.relations.policies.length > 0) {\n            await this.synchronizePolicies(attributes, input.relations.policies);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private async synchronizePolicies(permission: Permission, policyNames: string[]): Promise<void> {\n        if (!this.policyRepository || !this.permissionPolicyRepository) {\n            throw new Error(\n                'Provisioning: policy/permissionPolicy repositories must be wired to attach policies to permissions.',\n            );\n        }\n\n        for (const policyName of policyNames) {\n            const policy = await this.policyRepository.findOneByName(policyName);\n            if (!policy) {\n                throw new Error(\n                    `Provisioning: policy '${policyName}' not found for permission '${permission.name}'.`,\n                );\n            }\n\n            const existing = await this.permissionPolicyRepository.findOneBy({\n                permission_id: permission.id,\n                policy_id: policy.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.permissionPolicyRepository.create({\n                permission_id: permission.id,\n                permission_realm_id: permission.realm_id,\n                policy_id: policy.id,\n                policy_realm_id: policy.realm_id,\n            });\n            await this.permissionPolicyRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;AAgBA,IAAaI,qCAAb,cAAwDD,6BAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;AACxD,SAAK;AAEL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,mBAAmBE,IAAIF;AAC5B,OAAKC,6BAA6BC,IAAID;;CAG1C,MAAME,YAAYC,OAA4E;EAC1F,MAAMC,WAAWT,oCAAoCQ,MAAMC,SAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKP,WAAWQ,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GACvCC,WAAWN,MAAME,WAAWI,aAAa;GAC7C,CAAA;AAEA,MAAIL,SAASM,SAAShB,+BAA+BiB,QAAQ;AACzD,OAAIN,WACA,OAAM,KAAKP,WAAWc,OAAOP,WAAAA;AAEjC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASM,MAAjB;GACI,KAAKhB,+BAA+BmB;AAChCR,iBAAa,KAAKP,WAAWgB,MACzBT,YACAD,SAASC,aACLZ,WAAWU,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKP,WAAWiB,KAAKV,WAAAA;AACxC;GACJ,KAAKX,+BAA+BsB;AAChCb,UAAME,WAAWY,KAAKZ,WAAWY;AACjCZ,iBAAa,MAAM,KAAKP,WAAWiB,KAAK,KAAKjB,WAAWoB,OAAOf,MAAME,WAAU,CAAA;AAC/E;;MAGRA,cAAa,MAAM,KAAKP,WAAWiB,KAAK,KAAKjB,WAAWoB,OAAOf,MAAME,WAAU,CAAA;AAGnF,MAAIF,MAAMgB,WAAWC,YAAYjB,MAAMgB,UAAUC,SAASC,SAAS,EAC/D,OAAM,KAAKC,oBAAoBjB,YAAYF,MAAMgB,UAAUC,SAAQ;AAGvE,SAAO;GACH,GAAGjB;GACHE;GACJ;;CAGJ,MAAciB,oBAAoBC,YAAwBC,aAAsC;AAC5F,MAAI,CAAC,KAAKzB,oBAAoB,CAAC,KAAKC,2BAChC,OAAM,IAAIyB,MACN,sGAAA;AAIR,OAAK,MAAMC,cAAcF,aAAa;GAClC,MAAMG,SAAS,MAAM,KAAK5B,iBAAiB6B,cAAcF,WAAAA;AACzD,OAAI,CAACC,OACD,OAAM,IAAIF,MACN,yBAAyBC,WAAW,8BAA8BH,WAAWhB,KAAK,IAAG;AAQ7F,OAAIsB,MAJmB,KAAK7B,2BAA2BM,UAAU;IAC7DwB,eAAeP,WAAWN;IAC1Bc,WAAWJ,OAAOV;IACtB,CAAA,CAEI;GAGJ,MAAMe,QAAQ,KAAKhC,2BAA2BkB,OAAO;IACjDY,eAAeP,WAAWN;IAC1BgB,qBAAqBV,WAAWf;IAChCuB,WAAWJ,OAAOV;IAClBiB,iBAAiBP,OAAOnB;IAC5B,CAAA;AACA,SAAM,KAAKR,2BAA2Be,KAAKiB,MAAAA"}

package/dist/core/provisioning/synchronizer/permission/types.d.ts

@@ -1,5 +1,8 @@
-import type { IPermissionRepository } from '../../../entities/index.ts';
+import type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';
+import type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';
 export type PermissionProvisioningSynchronizerContext = {
     repository: IPermissionRepository;
+    policyRepository?: IPolicyRepository;
+    permissionPolicyRepository?: IPermissionPolicyRepository;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/permission/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,MAAM,MAAM,yCAAyC,GAAG;IACpD,UAAU,EAAE,qBAAqB,CAAC;CACrC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE3F,MAAM,MAAM,yCAAyC,GAAG;IACpD,UAAU,EAAE,qBAAqB,CAAC;IAClC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,0BAA0B,CAAC,EAAE,2BAA2B,CAAC;CAC5D,CAAC"}

package/dist/core/provisioning/synchronizer/policy/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,8BAA+B,SAAQ,4BAA4B,CAAC,wBAAwB,CAAC;IACtG,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,GAAG,EAAE,qCAAqC;IAOhD,WAAW,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;YA2BvE,mBAAmB;YAgBnB,oBAAoB;YAgBpB,iBAAiB;CAclC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,8BAA+B,SAAQ,4BAA4B,CAAC,wBAAwB,CAAC;IACtG,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,GAAG,EAAE,qCAAqC;IAOhD,WAAW,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;YAmCvE,mBAAmB;YAgBnB,oBAAoB;YAgBpB,iBAAiB;CAclC"}

package/dist/core/provisioning/synchronizer/policy/module.mjs

@@ -14,12 +14,14 @@ var PolicyProvisioningSynchronizer = class extends BaseProvisioningSynchronizer
 			realm_id: input.attributes.realm_id || null
 		});
 		if (entity) {
-			entity = this.repository.merge(entity, {
+			const mergeData = {
 				type: input.attributes.type,
 				built_in: input.attributes.built_in,
 				parent_id: input.attributes.parent_id,
 				parent: input.attributes.parent
-			});
+			};
+			if (typeof input.attributes.invert !== "undefined") mergeData.invert = input.attributes.invert;
+			entity = this.repository.merge(entity, mergeData);
 			await this.repository.saveWithEA(entity, input.extraAttributes);
 		} else {
 			entity = this.repository.create(input.attributes);

package/dist/core/provisioning/synchronizer/policy/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BaseProvisioningSynchronizer","PolicyProvisioningSynchronizer","repository","permissionPolicyRepository","ctx","synchronize","input","entity","findOneBy","name","attributes","realm_id","merge","type","built_in","parent_id","parent","saveWithEA","extraAttributes","create","synchronizeChildren","id","children","parentId","declaredNames","map","c","reduce","prev","child","Promise","resolve","cleanupStaleChildren","existingChildren","findManyBy","staleChildren","filter","includes","cleanupStaleChild","referencingJunctions","policy_id","length","deleteFromTree","detached"],"sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Policy } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPolicyRepository } from '../../../entities/index.ts';\nimport type { PolicyProvisioningEntity } from '../../entities/policy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PolicyProvisioningSynchronizerContext } from './types.ts';\n\nexport class PolicyProvisioningSynchronizer extends BaseProvisioningSynchronizer<PolicyProvisioningEntity> {\n    protected repository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    constructor(ctx: PolicyProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PolicyProvisioningEntity): Promise<PolicyProvisioningEntity> {\n        let entity = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (entity) {\n            entity = this.repository.merge(entity, {\n                type: input.attributes.type,\n                built_in: input.attributes.built_in,\n                parent_id: input.attributes.parent_id,\n                parent: input.attributes.parent,\n            });\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        } else {\n            entity = this.repository.create(input.attributes);\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        }\n\n        await this.synchronizeChildren(entity.id, input.children || []);\n\n        return {\n            ...input,\n            attributes: entity,\n        };\n    }\n\n    private async synchronizeChildren(\n        parentId: string,\n        children: PolicyProvisioningEntity[] = [],\n    ): Promise<void> {\n        const declaredNames = children.map((c) => c.attributes.name);\n\n        await children.reduce(async (prev, child) => {\n            await prev;\n            child.attributes.parent_id = parentId;\n            child.attributes.parent = { id: parentId } as any;\n            await this.synchronize(child);\n        }, Promise.resolve());\n\n        await this.cleanupStaleChildren(parentId, declaredNames);\n    }\n\n    private async cleanupStaleChildren(\n        parentId: string,\n        declaredNames: (string | undefined)[],\n    ): Promise<void> {\n        const existingChildren = await this.repository.findManyBy({ parent_id: parentId });\n\n        const staleChildren = existingChildren.filter(\n            (child) => !declaredNames.includes(child.name),\n        );\n\n        await staleChildren.reduce(async (prev, child) => {\n            await prev;\n            await this.cleanupStaleChild(child);\n        }, Promise.resolve());\n    }\n\n    private async cleanupStaleChild(child: Policy): Promise<void> {\n        const referencingJunctions = await this.permissionPolicyRepository.findManyBy({ policy_id: child.id });\n\n        if (referencingJunctions.length === 0) {\n            await this.repository.deleteFromTree(child);\n        } else {\n            const detached = this.repository.merge(child, {\n                parent_id: null,\n                parent: null,\n                built_in: false,\n            });\n            await this.repository.saveWithEA(detached);\n        }\n    }\n}\n"],"mappings":";;AAcA,IAAaC,iCAAb,cAAoDD,6BAAAA;CACtCE;CAEAC;CAEV,YAAYC,KAA4C;AACpD,SAAK;AAEL,OAAKF,aAAaE,IAAIF;AACtB,OAAKC,6BAA6BC,IAAID;;CAG1C,MAAME,YAAYC,OAAoE;EAClF,IAAIC,SAAS,MAAM,KAAKL,WAAWM,UAAU;GACzCC,MAAMH,MAAMI,WAAWD;GACvBE,UAAUL,MAAMI,WAAWC,YAAY;GAC3C,CAAA;AAEA,MAAIJ,QAAQ;AACRA,YAAS,KAAKL,WAAWU,MAAML,QAAQ;IACnCM,MAAMP,MAAMI,WAAWG;IACvBC,UAAUR,MAAMI,WAAWI;IAC3BC,WAAWT,MAAMI,WAAWK;IAC5BC,QAAQV,MAAMI,WAAWM;IAC7B,CAAA;AACA,SAAM,KAAKd,WAAWe,WAAWV,QAAQD,MAAMY,gBAAe;SAC3D;AACHX,YAAS,KAAKL,WAAWiB,OAAOb,MAAMI,WAAU;AAChD,SAAM,KAAKR,WAAWe,WAAWV,QAAQD,MAAMY,gBAAe;;AAGlE,QAAM,KAAKE,oBAAoBb,OAAOc,IAAIf,MAAMgB,YAAY,EAAE,CAAA;AAE9D,SAAO;GACH,GAAGhB;GACHI,YAAYH;GAChB;;CAGJ,MAAca,oBACVG,UACAD,WAAuC,EAAE,EAC5B;EACb,MAAME,gBAAgBF,SAASG,KAAKC,MAAMA,EAAEhB,WAAWD,KAAI;AAE3D,QAAMa,SAASK,OAAO,OAAOC,MAAMC,UAAAA;AAC/B,SAAMD;AACNC,SAAMnB,WAAWK,YAAYQ;AAC7BM,SAAMnB,WAAWM,SAAS,EAAEK,IAAIE,UAAS;AACzC,SAAM,KAAKlB,YAAYwB,MAAAA;KACxBC,QAAQC,SAAO,CAAA;AAElB,QAAM,KAAKC,qBAAqBT,UAAUC,cAAAA;;CAG9C,MAAcQ,qBACVT,UACAC,eACa;AAOb,SAJsBS,MAFS,KAAK/B,WAAWgC,WAAW,EAAEnB,WAAWQ,UAAS,CAAA,EAEzCa,QAClCP,UAAU,CAACL,cAAca,SAASR,MAAMpB,KAAI,CAG3C0B,CAAcR,OAAO,OAAOC,MAAMC,UAAAA;AACpC,SAAMD;AACN,SAAM,KAAKU,kBAAkBT,MAAAA;KAC9BC,QAAQC,SAAO,CAAA;;CAGtB,MAAcO,kBAAkBT,OAA8B;AAG1D,OAAIU,MAF+B,KAAKpC,2BAA2B+B,WAAW,EAAEM,WAAWX,MAAMR,IAAG,CAAA,EAE3EoB,WAAW,EAChC,OAAM,KAAKvC,WAAWwC,eAAeb,MAAAA;OAClC;GACH,MAAMc,WAAW,KAAKzC,WAAWU,MAAMiB,OAAO;IAC1Cd,WAAW;IACXC,QAAQ;IACRF,UAAU;IACd,CAAA;AACA,SAAM,KAAKZ,WAAWe,WAAW0B,SAAAA"}
+{"version":3,"file":"module.mjs","names":["BaseProvisioningSynchronizer","PolicyProvisioningSynchronizer","repository","permissionPolicyRepository","ctx","synchronize","input","entity","findOneBy","name","attributes","realm_id","mergeData","type","built_in","parent_id","parent","invert","merge","saveWithEA","extraAttributes","create","synchronizeChildren","id","children","parentId","declaredNames","map","c","reduce","prev","child","Promise","resolve","cleanupStaleChildren","existingChildren","findManyBy","staleChildren","filter","includes","cleanupStaleChild","referencingJunctions","policy_id","length","deleteFromTree","detached"],"sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Policy } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPolicyRepository } from '../../../entities/index.ts';\nimport type { PolicyProvisioningEntity } from '../../entities/policy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PolicyProvisioningSynchronizerContext } from './types.ts';\n\nexport class PolicyProvisioningSynchronizer extends BaseProvisioningSynchronizer<PolicyProvisioningEntity> {\n    protected repository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    constructor(ctx: PolicyProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PolicyProvisioningEntity): Promise<PolicyProvisioningEntity> {\n        let entity = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (entity) {\n            // Only assign `invert` when the source declares it explicitly.\n            // TypeORM's `merge` is a plain assign and would otherwise clobber\n            // an existing flag with `undefined` (turning `invert: true` into\n            // `null`/`false` on every reprovisioning pass).\n            const mergeData: Partial<Policy> = {\n                type: input.attributes.type,\n                built_in: input.attributes.built_in,\n                parent_id: input.attributes.parent_id,\n                parent: input.attributes.parent,\n            };\n            if (typeof input.attributes.invert !== 'undefined') {\n                mergeData.invert = input.attributes.invert;\n            }\n            entity = this.repository.merge(entity, mergeData);\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        } else {\n            entity = this.repository.create(input.attributes);\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        }\n\n        await this.synchronizeChildren(entity.id, input.children || []);\n\n        return {\n            ...input,\n            attributes: entity,\n        };\n    }\n\n    private async synchronizeChildren(\n        parentId: string,\n        children: PolicyProvisioningEntity[] = [],\n    ): Promise<void> {\n        const declaredNames = children.map((c) => c.attributes.name);\n\n        await children.reduce(async (prev, child) => {\n            await prev;\n            child.attributes.parent_id = parentId;\n            child.attributes.parent = { id: parentId } as any;\n            await this.synchronize(child);\n        }, Promise.resolve());\n\n        await this.cleanupStaleChildren(parentId, declaredNames);\n    }\n\n    private async cleanupStaleChildren(\n        parentId: string,\n        declaredNames: (string | undefined)[],\n    ): Promise<void> {\n        const existingChildren = await this.repository.findManyBy({ parent_id: parentId });\n\n        const staleChildren = existingChildren.filter(\n            (child) => !declaredNames.includes(child.name),\n        );\n\n        await staleChildren.reduce(async (prev, child) => {\n            await prev;\n            await this.cleanupStaleChild(child);\n        }, Promise.resolve());\n    }\n\n    private async cleanupStaleChild(child: Policy): Promise<void> {\n        const referencingJunctions = await this.permissionPolicyRepository.findManyBy({ policy_id: child.id });\n\n        if (referencingJunctions.length === 0) {\n            await this.repository.deleteFromTree(child);\n        } else {\n            const detached = this.repository.merge(child, {\n                parent_id: null,\n                parent: null,\n                built_in: false,\n            });\n            await this.repository.saveWithEA(detached);\n        }\n    }\n}\n"],"mappings":";;AAcA,IAAaC,iCAAb,cAAoDD,6BAAAA;CACtCE;CAEAC;CAEV,YAAYC,KAA4C;AACpD,SAAK;AAEL,OAAKF,aAAaE,IAAIF;AACtB,OAAKC,6BAA6BC,IAAID;;CAG1C,MAAME,YAAYC,OAAoE;EAClF,IAAIC,SAAS,MAAM,KAAKL,WAAWM,UAAU;GACzCC,MAAMH,MAAMI,WAAWD;GACvBE,UAAUL,MAAMI,WAAWC,YAAY;GAC3C,CAAA;AAEA,MAAIJ,QAAQ;GAKR,MAAMK,YAA6B;IAC/BC,MAAMP,MAAMI,WAAWG;IACvBC,UAAUR,MAAMI,WAAWI;IAC3BC,WAAWT,MAAMI,WAAWK;IAC5BC,QAAQV,MAAMI,WAAWM;IAC7B;AACA,OAAI,OAAOV,MAAMI,WAAWO,WAAW,YACnCL,WAAUK,SAASX,MAAMI,WAAWO;AAExCV,YAAS,KAAKL,WAAWgB,MAAMX,QAAQK,UAAAA;AACvC,SAAM,KAAKV,WAAWiB,WAAWZ,QAAQD,MAAMc,gBAAe;SAC3D;AACHb,YAAS,KAAKL,WAAWmB,OAAOf,MAAMI,WAAU;AAChD,SAAM,KAAKR,WAAWiB,WAAWZ,QAAQD,MAAMc,gBAAe;;AAGlE,QAAM,KAAKE,oBAAoBf,OAAOgB,IAAIjB,MAAMkB,YAAY,EAAE,CAAA;AAE9D,SAAO;GACH,GAAGlB;GACHI,YAAYH;GAChB;;CAGJ,MAAce,oBACVG,UACAD,WAAuC,EAAE,EAC5B;EACb,MAAME,gBAAgBF,SAASG,KAAKC,MAAMA,EAAElB,WAAWD,KAAI;AAE3D,QAAMe,SAASK,OAAO,OAAOC,MAAMC,UAAAA;AAC/B,SAAMD;AACNC,SAAMrB,WAAWK,YAAYU;AAC7BM,SAAMrB,WAAWM,SAAS,EAAEO,IAAIE,UAAS;AACzC,SAAM,KAAKpB,YAAY0B,MAAAA;KACxBC,QAAQC,SAAO,CAAA;AAElB,QAAM,KAAKC,qBAAqBT,UAAUC,cAAAA;;CAG9C,MAAcQ,qBACVT,UACAC,eACa;AAOb,SAJsBS,MAFS,KAAKjC,WAAWkC,WAAW,EAAErB,WAAWU,UAAS,CAAA,EAEzCa,QAClCP,UAAU,CAACL,cAAca,SAASR,MAAMtB,KAAI,CAG3C4B,CAAcR,OAAO,OAAOC,MAAMC,UAAAA;AACpC,SAAMD;AACN,SAAM,KAAKU,kBAAkBT,MAAAA;KAC9BC,QAAQC,SAAO,CAAA;;CAGtB,MAAcO,kBAAkBT,OAA8B;AAG1D,OAAIU,MAF+B,KAAKtC,2BAA2BiC,WAAW,EAAEM,WAAWX,MAAMR,IAAG,CAAA,EAE3EoB,WAAW,EAChC,OAAM,KAAKzC,WAAW0C,eAAeb,MAAAA;OAClC;GACH,MAAMc,WAAW,KAAK3C,WAAWgB,MAAMa,OAAO;IAC1ChB,WAAW;IACXC,QAAQ;IACRF,UAAU;IACd,CAAA;AACA,SAAM,KAAKZ,WAAWiB,WAAW0B,SAAAA"}