@authup/server-core 1.0.0-beta.37 → 1.0.0-beta.39

package/dist/app/modules/oauth2/module.mjs

@@ -83,10 +83,13 @@ var OAuth2Module = class {
 			return new OAuth2TokenVerifier(c.resolve(OAuth2InjectionToken.KeyRepository), c.resolve(OAuth2InjectionToken.TokenRepository));
 		} });
 		container.register(OAuth2InjectionToken.AccessTokenIssuer, { useFactory: (c) => {
-			return new OAuth2AccessTokenIssuer(c.resolve(OAuth2InjectionToken.TokenRepository), c.resolve(OAuth2InjectionToken.TokenSigner), {
+			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
+			const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);
+			const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);
+			return new OAuth2AccessTokenIssuer(tokenRepository, tokenSigner, {
 				maxAge: config.tokenAccessMaxAge,
 				issuer: config.publicUrl
-			});
+			}, identityRoleProvider);
 		} });
 		container.register(OAuth2InjectionToken.RefreshTokenIssuer, { useFactory: (c) => {
 			return new OAuth2RefreshTokenIssuer(c.resolve(OAuth2InjectionToken.TokenRepository), c.resolve(OAuth2InjectionToken.TokenSigner), {

package/dist/app/modules/oauth2/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["CacheInjectionKey","ModuleName","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2KeyRepository","OAuth2ScopeRepository","OAuth2TokenRepository","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","KeyRepository","TokenSigner","keyRepository","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","issuer","publicUrl","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\n\nimport {\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2KeyRepository,\n    OAuth2ScopeRepository, \n    OAuth2TokenRepository,\n} from './repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.KeyRepository, {\n            // todo: cache use here\n            useFactory: () => new OAuth2KeyRepository(),\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n                return new OAuth2TokenSigner(keyRepository);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyRepository, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,IAAauB,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;AACV,OAAKD,OAAOvB,WAAWyB;AACvB,OAAKD,eAAe;GAACxB,WAAW0B;GAAU1B,WAAW2B;GAAO3B,WAAW4B;GAAQ5B,WAAW6B;GAAS;;CAGvG,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQZ,mBAAAA;AAEjCU,YAAUG,SAASjB,qBAAqBkB,kBAAkB,EACtDC,aAAaC,MAAAA;AAET,UAAO,IAAIlC,uBADQkC,EAAEJ,QAAkCd,aACrBmB,CAAAA;KAE1C,CAAA;AAEAP,YAAUG,SAASjB,qBAAqBsB,iBAAiB,EACrDH,aAAaC,MAAAA;AAET,UAAO,IAAIhC,sBADQgC,EAAEJ,QAAuCb,kBAC3BkB,CAAAA;KAEzC,CAAA;AAEAP,YAAUG,SAASjB,qBAAqBuB,6BAA6B,EACjEJ,aAAaC,MAAAA;AAET,UAAO,IAAIpC,kCADGoC,EAAEJ,QAAQlC,kBACqB0C,CAAAA;KAErD,CAAA;AAEAV,YAAUG,SAASjB,qBAAqByB,8BAA8B,EAClEN,aAAaC,MAAAA;AAET,UAAO,IAAInC,mCADGmC,EAAEJ,QAAQlC,kBACsB0C,CAAAA;KAEtD,CAAA;AAEAV,YAAUG,SAASjB,qBAAqB0B,iBAAiB,EACrDP,aAAaC,MAAAA;AAET,UAAO,IAAI/B,sBADG+B,EAAEJ,QAAQlC,kBACS0C,CAAAA;KAEzC,CAAA;AAEAV,YAAUG,SAASjB,qBAAqB2B,eAAe,EAEnDR,kBAAkB,IAAIhC,qBAAAA,EAC1B,CAAA;AAEA2B,YAAUG,SAASjB,qBAAqB4B,aAAa,EACjDT,aAAaC,MAAAA;AAET,UAAO,IAAItB,kBADWsB,EAAEJ,QAAQhB,qBAAqB2B,cACxBE,CAAAA;KAErC,CAAA;AAGAf,YAAUG,SAASjB,qBAAqB8B,yBAAyB,EAC7DX,aAAaC,MAAAA;AAGT,UAAO,IAAI7B,8BAFY6B,EAAEJ,QAAQhB,qBAAqBuB,4BAGlDQ,EACA,EAEIC,QAAQjB,OAAOkB,mBACnB,CAAA;KAGZ,CAAA;AACAnB,YAAUG,SAASjB,qBAAqBkC,2BAA2B,EAC/Df,aAAaC,MAAAA;AAGT,UAAO,IAAI3B,gCAFY2B,EAAEJ,QAAQhB,qBAAqBuB,4BAEXQ,CAAAA;KAEnD,CAAA;AAGAjB,YAAUG,SAASjB,qBAAqBmC,kCAAkC,EACtEhB,aAAaC,MAAAA;AAIT,UAAO,IAAI5B,uCAAuC;IAC9C4C,kBAJqBhB,EAAEJ,QAAQhB,qBAAqBkB,iBAIpDkB;IACAE,iBAJ0BlB,EAAEJ,QAAQhB,qBAAqBsB,gBAIxCe;IACrB,CAAA;KAER,CAAA;AAEAvB,YAAUG,SAASjB,qBAAqBuC,2BAA2B,EAC/DpB,aAAaC,MAAAA;AAGT,UAAO,IAAI1B,gCAFa0B,EAAEJ,QAAQhB,qBAAqByB,6BAEZe,CAAAA;KAEnD,CAAA;AAGA1B,YAAUG,SAASjB,qBAAqByC,cAAc,EAClDtB,aAAaC,MAAAA;AAET,UAAO,IAAIvB,mBADauB,EAAEJ,QAAQhB,qBAAqB0B,gBACzBgB,CAAAA;KAEtC,CAAA;AAGA5B,YAAUG,SAASjB,qBAAqB2C,eAAe,EACnDxB,aAAaC,MAAAA;AAIT,UAAO,IAAIrB,oBAHWqB,EAAEJ,QAAQhB,qBAAqB2B,cAGtBE,EAFPT,EAAEJ,QAAQhB,qBAAqB0B,gBAETgB,CAAAA;KAEtD,CAAA;AAGA5B,YAAUG,SAASjB,qBAAqB4C,mBAAmB,EACvDzB,aAAaC,MAAAA;AAGT,UAAO,IAAI9B,wBAFa8B,EAAEJ,QAAQhB,qBAAqB0B,gBAGnDgB,EAFgBtB,EAAEJ,QAAQhB,qBAAqB4B,YAG/CiB,EACA;IACIb,QAAQjB,OAAOkB;IACfa,QAAQ/B,OAAOgC;IACnB,CAAA;KAGZ,CAAA;AAGAjC,YAAUG,SAASjB,qBAAqBgD,oBAAoB,EACxD7B,aAAaC,MAAAA;AAIT,UAAO,IAAIxB,yBAHawB,EAAEJ,QAAQhB,qBAAqB0B,gBAInDgB,EAHgBtB,EAAEJ,QAAQhB,qBAAqB4B,YAI/CiB,EACA;IACIb,QAAQjB,OAAOkC;IACfH,QAAQ/B,OAAOgC;IACnB,CAAA;KAGZ,CAAA;AAGAjC,YAAUG,SAASjB,qBAAqBkD,mBAAmB,EACvD/B,aAAaC,MAAAA;AAKT,UAAO,IAAIzB,wBAAwB;IAC/B0B,YALeD,EAAEJ,QAAQhB,qBAAqB0B,gBAK9CL;IACA8B,QALW/B,EAAEJ,QAAQhB,qBAAqB4B,YAK1CuB;IAEAC,kBANqBhC,EAAEJ,QAAQf,qBAAqBoD,SAMpDD;IAEAE,SAAS;KAELtB,QAAQjB,OAAOkB;KACfa,QAAQ/B,OAAOgC;KACnB;IACJ,CAAA;KAER,CAAA"}
+{"version":3,"file":"module.mjs","names":["CacheInjectionKey","ModuleName","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2KeyRepository","OAuth2ScopeRepository","OAuth2TokenRepository","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","KeyRepository","TokenSigner","keyRepository","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\n\nimport {\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2KeyRepository,\n    OAuth2ScopeRepository,\n    OAuth2TokenRepository,\n} from './repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.KeyRepository, {\n            // todo: cache use here\n            useFactory: () => new OAuth2KeyRepository(),\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n                return new OAuth2TokenSigner(keyRepository);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyRepository, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    identityRoleProvider,\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,IAAauB,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;AACV,OAAKD,OAAOvB,WAAWyB;AACvB,OAAKD,eAAe;GAACxB,WAAW0B;GAAU1B,WAAW2B;GAAO3B,WAAW4B;GAAQ5B,WAAW6B;GAAS;;CAGvG,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQZ,mBAAAA;AAEjCU,YAAUG,SAASjB,qBAAqBkB,kBAAkB,EACtDC,aAAaC,MAAAA;AAET,UAAO,IAAIlC,uBADQkC,EAAEJ,QAAkCd,aACrBmB,CAAAA;KAE1C,CAAA;AAEAP,YAAUG,SAASjB,qBAAqBsB,iBAAiB,EACrDH,aAAaC,MAAAA;AAET,UAAO,IAAIhC,sBADQgC,EAAEJ,QAAuCb,kBAC3BkB,CAAAA;KAEzC,CAAA;AAEAP,YAAUG,SAASjB,qBAAqBuB,6BAA6B,EACjEJ,aAAaC,MAAAA;AAET,UAAO,IAAIpC,kCADGoC,EAAEJ,QAAQlC,kBACqB0C,CAAAA;KAErD,CAAA;AAEAV,YAAUG,SAASjB,qBAAqByB,8BAA8B,EAClEN,aAAaC,MAAAA;AAET,UAAO,IAAInC,mCADGmC,EAAEJ,QAAQlC,kBACsB0C,CAAAA;KAEtD,CAAA;AAEAV,YAAUG,SAASjB,qBAAqB0B,iBAAiB,EACrDP,aAAaC,MAAAA;AAET,UAAO,IAAI/B,sBADG+B,EAAEJ,QAAQlC,kBACS0C,CAAAA;KAEzC,CAAA;AAEAV,YAAUG,SAASjB,qBAAqB2B,eAAe,EAEnDR,kBAAkB,IAAIhC,qBAAAA,EAC1B,CAAA;AAEA2B,YAAUG,SAASjB,qBAAqB4B,aAAa,EACjDT,aAAaC,MAAAA;AAET,UAAO,IAAItB,kBADWsB,EAAEJ,QAAQhB,qBAAqB2B,cACxBE,CAAAA;KAErC,CAAA;AAGAf,YAAUG,SAASjB,qBAAqB8B,yBAAyB,EAC7DX,aAAaC,MAAAA;AAGT,UAAO,IAAI7B,8BAFY6B,EAAEJ,QAAQhB,qBAAqBuB,4BAGlDQ,EACA,EAEIC,QAAQjB,OAAOkB,mBACnB,CAAA;KAGZ,CAAA;AACAnB,YAAUG,SAASjB,qBAAqBkC,2BAA2B,EAC/Df,aAAaC,MAAAA;AAGT,UAAO,IAAI3B,gCAFY2B,EAAEJ,QAAQhB,qBAAqBuB,4BAEXQ,CAAAA;KAEnD,CAAA;AAGAjB,YAAUG,SAASjB,qBAAqBmC,kCAAkC,EACtEhB,aAAaC,MAAAA;AAIT,UAAO,IAAI5B,uCAAuC;IAC9C4C,kBAJqBhB,EAAEJ,QAAQhB,qBAAqBkB,iBAIpDkB;IACAE,iBAJ0BlB,EAAEJ,QAAQhB,qBAAqBsB,gBAIxCe;IACrB,CAAA;KAER,CAAA;AAEAvB,YAAUG,SAASjB,qBAAqBuC,2BAA2B,EAC/DpB,aAAaC,MAAAA;AAGT,UAAO,IAAI1B,gCAFa0B,EAAEJ,QAAQhB,qBAAqByB,6BAEZe,CAAAA;KAEnD,CAAA;AAGA1B,YAAUG,SAASjB,qBAAqByC,cAAc,EAClDtB,aAAaC,MAAAA;AAET,UAAO,IAAIvB,mBADauB,EAAEJ,QAAQhB,qBAAqB0B,gBACzBgB,CAAAA;KAEtC,CAAA;AAGA5B,YAAUG,SAASjB,qBAAqB2C,eAAe,EACnDxB,aAAaC,MAAAA;AAIT,UAAO,IAAIrB,oBAHWqB,EAAEJ,QAAQhB,qBAAqB2B,cAGtBE,EAFPT,EAAEJ,QAAQhB,qBAAqB0B,gBAETgB,CAAAA;KAEtD,CAAA;AAGA5B,YAAUG,SAASjB,qBAAqB4C,mBAAmB,EACvDzB,aAAaC,MAAAA;GACT,MAAMsB,kBAAkBtB,EAAEJ,QAAQhB,qBAAqB0B,gBAAe;GACtE,MAAMmB,cAAczB,EAAEJ,QAAQhB,qBAAqB4B,YAAW;GAC9D,MAAMkB,uBAAuB1B,EAAEJ,QAAQf,qBAAqB8C,aAAY;AACxE,UAAO,IAAIzD,wBACPoD,iBACAG,aACA;IACIb,QAAQjB,OAAOkB;IACfe,QAAQjC,OAAOkC;IACnB,EACAH,qBAAAA;KAGZ,CAAA;AAGAhC,YAAUG,SAASjB,qBAAqBkD,oBAAoB,EACxD/B,aAAaC,MAAAA;AAIT,UAAO,IAAIxB,yBAHawB,EAAEJ,QAAQhB,qBAAqB0B,gBAInDgB,EAHgBtB,EAAEJ,QAAQhB,qBAAqB4B,YAI/CiB,EACA;IACIb,QAAQjB,OAAOoC;IACfH,QAAQjC,OAAOkC;IACnB,CAAA;KAGZ,CAAA;AAGAnC,YAAUG,SAASjB,qBAAqBoD,mBAAmB,EACvDjC,aAAaC,MAAAA;AAKT,UAAO,IAAIzB,wBAAwB;IAC/B0B,YALeD,EAAEJ,QAAQhB,qBAAqB0B,gBAK9CL;IACAgC,QALWjC,EAAEJ,QAAQhB,qBAAqB4B,YAK1CyB;IAEAC,kBANqBlC,EAAEJ,QAAQf,qBAAqBsD,SAMpDD;IAEAE,SAAS;KAELxB,QAAQjB,OAAOkB;KACfe,QAAQjC,OAAOkC;KACnB;IACJ,CAAA;KAER,CAAA"}

package/dist/app/modules/provisioning/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAsBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAYxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAMH,uBAAuB,EAW1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAOrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cA4IjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAsBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAYxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAMH,uBAAuB,EAW1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAOrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAgJjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs

@@ -1,19 +1,19 @@
 import { RealmEntity } from "../../../adapters/database/domains/realm/entity.mjs";
 import { ClientEntity } from "../../../adapters/database/domains/client/entity.mjs";
+import { RoleEntity } from "../../../adapters/database/domains/role/entity.mjs";
+import { ClientRoleEntity } from "../../../adapters/database/domains/client-role/entity.mjs";
 import { PermissionEntity } from "../../../adapters/database/domains/permission/entity.mjs";
 import { PolicyRepository } from "../../../adapters/database/domains/policy/repository.mjs";
 import { ClientPermissionEntity } from "../../../adapters/database/domains/client-permission/entity.mjs";
-import { RoleEntity } from "../../../adapters/database/domains/role/entity.mjs";
-import { RolePermissionEntity } from "../../../adapters/database/domains/role-permission/entity.mjs";
-import { ClientRoleEntity } from "../../../adapters/database/domains/client-role/entity.mjs";
 import { ScopeEntity } from "../../../adapters/database/domains/scope/entity.mjs";
-import { UserPermissionEntity } from "../../../adapters/database/domains/user-permission/entity.mjs";
-import { UserRoleEntity } from "../../../adapters/database/domains/user-role/entity.mjs";
 import { UserRepository } from "../../../adapters/database/domains/user/repository.mjs";
 import { RobotEntity } from "../../../adapters/database/domains/robot/entity.mjs";
-import { RobotRoleEntity } from "../../../adapters/database/domains/robot-role/entity.mjs";
-import { RobotPermissionEntity } from "../../../adapters/database/domains/robot-permission/entity.mjs";
 import { PermissionPolicyEntity } from "../../../adapters/database/domains/permission-policy/entity.mjs";
+import { RobotPermissionEntity } from "../../../adapters/database/domains/robot-permission/entity.mjs";
+import { RobotRoleEntity } from "../../../adapters/database/domains/robot-role/entity.mjs";
+import { RolePermissionEntity } from "../../../adapters/database/domains/role-permission/entity.mjs";
+import { UserPermissionEntity } from "../../../adapters/database/domains/user-permission/entity.mjs";
+import { UserRoleEntity } from "../../../adapters/database/domains/user-role/entity.mjs";
 import "../../../adapters/database/domains/index.mjs";
 import { ClientProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/client/module.mjs";
 import { PermissionProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/permission/module.mjs";
@@ -80,9 +80,10 @@ var ProvisionerModule = class {
 			repository: new PolicyRepository(dataSource),
 			realmRepository
 		});
+		const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(container.resolve(PermissionPolicyEntity));
 		const policySynchronizer = new PolicyProvisioningSynchronizer({
 			repository: policyRepository,
-			permissionPolicyRepository: new PermissionPolicyRepositoryAdapter(container.resolve(PermissionPolicyEntity))
+			permissionPolicyRepository
 		});
 		const roleRepository = new RoleRepositoryAdapter({
 			repository: container.resolve(RoleEntity),
@@ -92,7 +93,11 @@ var ProvisionerModule = class {
 			repository: container.resolve(ClientEntity),
 			realmRepository
 		});
-		const permissionSynchronizer = new PermissionProvisioningSynchronizer({ repository: permissionRepository });
+		const permissionSynchronizer = new PermissionProvisioningSynchronizer({
+			repository: permissionRepository,
+			policyRepository,
+			permissionPolicyRepository
+		});
 		const roleSynchronizer = new RoleProvisioningSynchronizer({
 			repository: roleRepository,
 			permissionRepository,

package/dist/app/modules/provisioning/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RobotEntity","RobotPermissionEntity","RobotRoleEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RobotProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RobotPermissionRepositoryAdapter","RobotRepositoryAdapter","RobotRoleRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","robotSynchronizer","robotRepository","robotRoleRepository","robotPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","find","permission","hasAnyPolicy","findOneBy","permission_id","id","save","create","permission_realm_id","realm_id","policy_id","policy_realm_id"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    PermissionPolicy,\n    Realm,\n    Robot,\n    RobotPermission,\n    RobotRole,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    PermissionEntity,\n    RealmEntity,\n    RobotEntity,\n    RobotPermissionEntity,\n    RobotRoleEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RobotProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RobotPermissionRepositoryAdapter,\n    RobotRepositoryAdapter,\n    RobotRoleRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter,\n    UserRoleRepositoryAdapter,\n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({ cwd: provisioningDir }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({ repository: permissionRepository });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            policyRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const robotSynchronizer = new RobotProvisioningSynchronizer({\n            robotRepository: new RobotRepositoryAdapter({\n                repository: container.resolve<Repository<Robot>>(RobotEntity),\n                realmRepository,\n            }),\n            robotRoleRepository: new RobotRoleRepositoryAdapter(\n                container.resolve<Repository<RobotRole>>(RobotRoleEntity),\n            ),\n            robotPermissionRepository: new RobotPermissionRepositoryAdapter(\n                container.resolve<Repository<RobotPermission>>(RobotPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({\n            repository: new ScopeRepositoryAdapter({\n                repository: container.resolve<Repository<Scope>>(ScopeEntity),\n                realmRepository,\n            }),\n        });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            robotSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permission_id: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permission_id: permission.id,\n                    permission_realm_id: permission.realm_id,\n                    policy_id: defaultPolicy.id,\n                    policy_realm_id: defaultPolicy.realm_id,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,IAAaiD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,EAAE,EAAE;AAC7C,OAAKF,OAAOP,WAAWU;AACvB,OAAKF,eAAe,CAACR,WAAWW,QAAQX,WAAWY,SAAS;AAC5D,OAAKH,UAAUA;;CAGnB,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,QAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQb,mBAAAA;EACjC,MAAMc,kBAAkBf,KAAKgB,KAAKH,OAAOI,uBAAuB,eAAA;AAChE,MAAIlB,GAAGmB,WAAWH,gBAAAA,CACdR,SAAQY,KAAK,IAAIhB,uBAAuB,EAAEiB,KAAKL,iBAAgB,CAAA,CAAA;EAInE,MAAMO,OAAO,MAAMD,IADGnB,4BAA4BK,QAC/Bc,CAAUE,KAAKX,UAAAA;EAElC,MAAMY,aAAaZ,UAAUE,QAAQjB,qBAAqB4B,WAAU;EACpE,MAAMC,kBAAkBd,UAAUE,QAA2BvD,YAAAA;EAE7D,MAAMoE,uBAAuB,IAAI1C,4BAA4B;GACzD2C,YAAYhB,UAAUE,QAAsCxD,iBAAAA;GAC5DoE;GACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI3C,wBAAwB;GACjD0C,YAAY,IAAI1D,iBAAiBsD,WAAAA;GACjCE;GACJ,CAAA;EAUA,MAAMK,qBAAqB,IAAIxD,+BAA+B;GAC1DqD,YAAYC;GACZC,4BAAAA,IANmC9C,kCACnC4B,UAAUE,QAAsC7C,uBAAAA,CAKhD6D;GACJ,CAAA;EAEA,MAAME,iBAAiB,IAAIxC,sBAAsB;GAC7CoC,YAAYhB,UAAUE,QAA0BnD,WAAAA;GAChD+D;GACJ,CAAA;EACA,MAAMO,mBAAmB,IAAInD,wBAAwB;GACjD8C,YAAYhB,UAAUE,QAA4B3D,aAAAA;GAClDuE;GACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI5D,mCAAmC,EAAEsD,YAAYD,sBAAqB,CAAA;EAEzG,MAAMQ,mBAAmB,IAAIzD,6BAA6B;GACtDkD,YAAYI;GACZL;GACAE;GACAO,0BAA0B,IAAI7C,gCAC1BqB,UAAUE,QAAoClD,qBAAAA,CAAAA;GAEtD,CAAA;EAEA,MAAMyE,qBAAqB,IAAIjE,+BAA+B;GAC1D6D;GACAK,sBAAsB,IAAIvD,4BACtB6B,UAAUE,QAAgCzD,iBAAAA,CAAAA;GAE9CkF,4BAA4B,IAAI1D,kCAC5B+B,UAAUE,QAAsC1D,uBAAAA,CAAAA;GAGpD4E;GACAL;GAEAQ;GACAD;GACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAI5D,6BAA6B;GACtD6D,gBAAgB,IAAI9C,sBAAsB;IACtCiC,YAAY,IAAIzD,eAAeqD,WAAAA;IAC/BE;IACJ,CAAA;GACAgB,oBAAoB,IAAI9C,0BACpBgB,UAAUE,QAA8B/C,eAAAA,CAAAA;GAE5C4E,0BAA0B,IAAIjD,gCAC1BkB,UAAUE,QAAoChD,qBAAAA,CAAAA;GAGlDmE;GACAD;GACAL;GACJ,CAAA;EAEA,MAAMiB,oBAAoB,IAAInE,8BAA8B;GACxDoE,iBAAiB,IAAIxD,uBAAuB;IACxCuC,YAAYhB,UAAUE,QAA2BtD,YAAAA;IACjDkE;IACJ,CAAA;GACAoB,qBAAqB,IAAIxD,2BACrBsB,UAAUE,QAA+BpD,gBAAAA,CAAAA;GAE7CqF,2BAA2B,IAAI3D,iCAC3BwB,UAAUE,QAAqCrD,sBAAAA,CAAAA;GAGnDuE;GACAL;GACJ,CAAA;EAEA,MAAMqB,oBAAoB,IAAIrE,8BAA8B,EACxDiD,YAAY,IAAInC,uBAAuB;GACnCmC,YAAYhB,UAAUE,QAA2BjD,YAAAA;GACjD6D;GACJ,CAAA,EACJ,CAAA;AAqBA,QAAMwB,IARuB7E,8BAA8B;GACvD0D;GACAG;GACAC;GACAc,mBAAAA,IAf0BzE,8BAA8B;IACxDoD,YAAY,IAAIzC,uBAAuBuC,gBAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAI;IACAI;IACJ,CAMIC;GACAD;GACJ,CAEME,CAAiBC,YAAY7B,KAAAA;AAEnC,MAAIT,OAAOuC,mCACP,OAAM,KAAKC,oBAAoB7B,YAAYK,iBAAAA;;CAInD,MAAgBwB,oBACZ7B,YACAK,kBACa;EACb,MAAMyB,gBAAgB,MAAMzB,iBAAiB0B,cAAcvF,iBAAiBwF,QAAO;AACnF,MAAI,CAACF,cACD;EAGJ,MAAMG,iBAAiBjC,WAAWkC,cAAcpG,iBAAAA;EAChD,MAAMqG,eAAenC,WAAWkC,cAAczF,uBAAAA;EAE9C,MAAM2F,cAAc,MAAMH,eAAeI,MAAI;AAC7C,OAAK,MAAMC,cAAcF,YAGrB,KAAI,CAACG,MAFsBJ,aAAaK,UAAU,EAAEC,eAAeH,WAAWI,IAAG,CAAA,CAG7E,OAAMP,aAAaQ,KAAKR,aAAaS,OAAO;GACxCH,eAAeH,WAAWI;GAC1BG,qBAAqBP,WAAWQ;GAChCC,WAAWjB,cAAcY;GACzBM,iBAAiBlB,cAAcgB;GACnC,CAAA,CAAA"}
+{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RobotEntity","RobotPermissionEntity","RobotRoleEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RobotProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RobotPermissionRepositoryAdapter","RobotRepositoryAdapter","RobotRoleRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","robotSynchronizer","robotRepository","robotRoleRepository","robotPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","find","permission","hasAnyPolicy","findOneBy","permission_id","id","save","create","permission_realm_id","realm_id","policy_id","policy_realm_id"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    PermissionPolicy,\n    Realm,\n    Robot,\n    RobotPermission,\n    RobotRole,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    PermissionEntity,\n    RealmEntity,\n    RobotEntity,\n    RobotPermissionEntity,\n    RobotRoleEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RobotProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RobotPermissionRepositoryAdapter,\n    RobotRepositoryAdapter,\n    RobotRoleRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter,\n    UserRoleRepositoryAdapter,\n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({ cwd: provisioningDir }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            policyRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const robotSynchronizer = new RobotProvisioningSynchronizer({\n            robotRepository: new RobotRepositoryAdapter({\n                repository: container.resolve<Repository<Robot>>(RobotEntity),\n                realmRepository,\n            }),\n            robotRoleRepository: new RobotRoleRepositoryAdapter(\n                container.resolve<Repository<RobotRole>>(RobotRoleEntity),\n            ),\n            robotPermissionRepository: new RobotPermissionRepositoryAdapter(\n                container.resolve<Repository<RobotPermission>>(RobotPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            robotSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permission_id: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permission_id: permission.id,\n                    permission_realm_id: permission.realm_id,\n                    policy_id: defaultPolicy.id,\n                    policy_realm_id: defaultPolicy.realm_id,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,IAAaiD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,EAAE,EAAE;AAC7C,OAAKF,OAAOP,WAAWU;AACvB,OAAKF,eAAe,CAACR,WAAWW,QAAQX,WAAWY,SAAS;AAC5D,OAAKH,UAAUA;;CAGnB,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,QAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQb,mBAAAA;EACjC,MAAMc,kBAAkBf,KAAKgB,KAAKH,OAAOI,uBAAuB,eAAA;AAChE,MAAIlB,GAAGmB,WAAWH,gBAAAA,CACdR,SAAQY,KAAK,IAAIhB,uBAAuB,EAAEiB,KAAKL,iBAAgB,CAAA,CAAA;EAInE,MAAMO,OAAO,MAAMD,IADGnB,4BAA4BK,QAC/Bc,CAAUE,KAAKX,UAAAA;EAElC,MAAMY,aAAaZ,UAAUE,QAAQjB,qBAAqB4B,WAAU;EACpE,MAAMC,kBAAkBd,UAAUE,QAA2BvD,YAAAA;EAE7D,MAAMoE,uBAAuB,IAAI1C,4BAA4B;GACzD2C,YAAYhB,UAAUE,QAAsCxD,iBAAAA;GAC5DoE;GACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI3C,wBAAwB;GACjD0C,YAAY,IAAI1D,iBAAiBsD,WAAAA;GACjCE;GACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAI9C,kCACnC4B,UAAUE,QAAsC7C,uBAAAA,CAAAA;EAGpD,MAAM8D,qBAAqB,IAAIxD,+BAA+B;GAC1DqD,YAAYC;GACZC;GACJ,CAAA;EAEA,MAAME,iBAAiB,IAAIxC,sBAAsB;GAC7CoC,YAAYhB,UAAUE,QAA0BnD,WAAAA;GAChD+D;GACJ,CAAA;EACA,MAAMO,mBAAmB,IAAInD,wBAAwB;GACjD8C,YAAYhB,UAAUE,QAA4B3D,aAAAA;GAClDuE;GACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI5D,mCAAmC;GAClEsD,YAAYD;GACZE;GACAC;GACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAIzD,6BAA6B;GACtDkD,YAAYI;GACZL;GACAE;GACAO,0BAA0B,IAAI7C,gCAC1BqB,UAAUE,QAAoClD,qBAAAA,CAAAA;GAEtD,CAAA;EAEA,MAAMyE,qBAAqB,IAAIjE,+BAA+B;GAC1D6D;GACAK,sBAAsB,IAAIvD,4BACtB6B,UAAUE,QAAgCzD,iBAAAA,CAAAA;GAE9CkF,4BAA4B,IAAI1D,kCAC5B+B,UAAUE,QAAsC1D,uBAAAA,CAAAA;GAGpD4E;GACAL;GAEAQ;GACAD;GACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAI5D,6BAA6B;GACtD6D,gBAAgB,IAAI9C,sBAAsB;IACtCiC,YAAY,IAAIzD,eAAeqD,WAAAA;IAC/BE;IACJ,CAAA;GACAgB,oBAAoB,IAAI9C,0BACpBgB,UAAUE,QAA8B/C,eAAAA,CAAAA;GAE5C4E,0BAA0B,IAAIjD,gCAC1BkB,UAAUE,QAAoChD,qBAAAA,CAAAA;GAGlDmE;GACAD;GACAL;GACJ,CAAA;EAEA,MAAMiB,oBAAoB,IAAInE,8BAA8B;GACxDoE,iBAAiB,IAAIxD,uBAAuB;IACxCuC,YAAYhB,UAAUE,QAA2BtD,YAAAA;IACjDkE;IACJ,CAAA;GACAoB,qBAAqB,IAAIxD,2BACrBsB,UAAUE,QAA+BpD,gBAAAA,CAAAA;GAE7CqF,2BAA2B,IAAI3D,iCAC3BwB,UAAUE,QAAqCrD,sBAAAA,CAAAA;GAGnDuE;GACAL;GACJ,CAAA;EAOA,MAAMsB,oBAAoB,IAAItE,8BAA8B,EAAEiD,YAAYoB,IAL9CvD,uBAAuB;GAC/CmC,YAAYhB,UAAUE,QAA2BjD,YAAAA;GACjD6D;GACJ,CAE0EsB,EAAgB,CAAA;AAqB1F,QAAMG,IARuB9E,8BAA8B;GACvD0D;GACAG;GACAC;GACAe,mBAAAA,IAf0B1E,8BAA8B;IACxDoD,YAAY,IAAIzC,uBAAuBuC,gBAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAI;IACAK;IACJ,CAMIC;GACAD;GACJ,CAEME,CAAiBC,YAAY9B,KAAAA;AAEnC,MAAIT,OAAOwC,mCACP,OAAM,KAAKC,oBAAoB9B,YAAYK,iBAAAA;;CAInD,MAAgByB,oBACZ9B,YACAK,kBACa;EACb,MAAM0B,gBAAgB,MAAM1B,iBAAiB2B,cAAcxF,iBAAiByF,QAAO;AACnF,MAAI,CAACF,cACD;EAGJ,MAAMG,iBAAiBlC,WAAWmC,cAAcrG,iBAAAA;EAChD,MAAMsG,eAAepC,WAAWmC,cAAc1F,uBAAAA;EAE9C,MAAM4F,cAAc,MAAMH,eAAeI,MAAI;AAC7C,OAAK,MAAMC,cAAcF,YAGrB,KAAI,CAACG,MAFsBJ,aAAaK,UAAU,EAAEC,eAAeH,WAAWI,IAAG,CAAA,CAG7E,OAAMP,aAAaQ,KAAKR,aAAaS,OAAO;GACxCH,eAAeH,WAAWI;GAC1BG,qBAAqBP,WAAWQ;GAChCC,WAAWjB,cAAcY;GACzBM,iBAAiBlB,cAAcgB;GACnC,CAAA,CAAA"}

package/dist/app/modules/provisioning/sources/default/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IA0E3C,gBAAgB,IAAI,4BAA4B,EAAE;IAclD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IA4DhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA8F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAuI3C,gBAAgB,IAAI,4BAA4B,EAAE;IA6BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IA4DhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA8F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}

package/dist/app/modules/provisioning/sources/default/module.mjs

@@ -76,20 +76,76 @@ var DefaultProvisioningSource = class {
 					attribute_null_match_all: true,
 					identity_master_match_all: false
 				}
+			},
+			{
+				attributes: {
+					name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,
+					type: BuiltInPolicyType.ATTRIBUTE_NAMES,
+					invert: true,
+					built_in: true,
+					realm_id: null
+				},
+				extraAttributes: { names: [
+					"active",
+					"realm_id",
+					"is_confidential",
+					"secret_hashed",
+					"secret_encrypted"
+				] }
+			},
+			{
+				attributes: {
+					name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,
+					type: BuiltInPolicyType.ATTRIBUTE_NAMES,
+					invert: true,
+					built_in: true,
+					realm_id: null
+				},
+				extraAttributes: { names: [
+					"active",
+					"realm_id",
+					"user_id"
+				] }
+			},
+			{
+				attributes: {
+					name: SystemPolicyName.USER_NAMES_SELF_MANAGE,
+					type: BuiltInPolicyType.ATTRIBUTE_NAMES,
+					invert: true,
+					built_in: true,
+					realm_id: null
+				},
+				extraAttributes: { names: [
+					"active",
+					"name_locked",
+					"status",
+					"status_message",
+					"realm_id"
+				] }
 			}
 		];
 	}
 	buildPermissions() {
-		return Object.values(PermissionName).map((name) => ({
-			strategy: {
-				type: ProvisioningEntityStrategyType.MERGE,
-				attributes: ["built_in"]
-			},
-			attributes: {
-				name,
-				built_in: true
-			}
-		}));
+		const policiesByPermission = {
+			[PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],
+			[PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],
+			[PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE]
+		};
+		return Object.values(PermissionName).map((name) => {
+			const entity = {
+				strategy: {
+					type: ProvisioningEntityStrategyType.MERGE,
+					attributes: ["built_in"]
+				},
+				attributes: {
+					name,
+					built_in: true
+				}
+			};
+			const policies = policiesByPermission[name];
+			if (policies) entity.relations = { policies };
+			return entity;
+		});
 	}
 	buildScopes() {
 		return Object.values(ScopeName).map((name) => ({

package/dist/app/modules/provisioning/sources/default/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","DecisionStrategy","SystemPolicyName","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","REALM_MATCH","attribute_name","attribute_name_strict","identity_master_match_all","attribute_null_match_all","REALM_BOUND","REALM_OR_GLOBAL","buildPermissions","Object","values","map","strategy","MERGE","buildScopes","buildRoles","relations","globalPermissions","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","globalPermissionsPolicyName","globalPermissionsPolicyOverrides","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","is_confidential","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","policies","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, DecisionStrategy, SystemPolicyName } from '@authup/access';\nimport type {\n    Client, \n    Permission, \n    Robot, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    RobotCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.REALM_MATCH,\n                            type: BuiltInPolicyType.REALM_MATCH,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                        extraAttributes: {\n                            attribute_name: ['realm_id'],\n                            attribute_name_strict: false,\n                            identity_master_match_all: false,\n                            attribute_null_match_all: true,\n                        },\n                    },\n                ],\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.REALM_BOUND,\n                    type: BuiltInPolicyType.REALM_MATCH,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    attribute_name: ['realm_id'],\n                    attribute_name_strict: false,\n                    attribute_null_match_all: false,\n                    identity_master_match_all: false,\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.REALM_OR_GLOBAL,\n                    type: BuiltInPolicyType.REALM_MATCH,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    attribute_name: ['realm_id'],\n                    attribute_name_strict: false,\n                    attribute_null_match_all: true,\n                    identity_master_match_all: false,\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        return Object.values(PermissionName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Permission)[],\n                },\n                attributes: {\n                    name,\n                    built_in: true,\n                },\n            }));\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    built_in: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: { globalPermissions: ['*'] },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    globalPermissionsPolicyName: SystemPolicyName.REALM_OR_GLOBAL,\n                    globalPermissionsPolicyOverrides: {\n                        [SystemPolicyName.REALM_BOUND]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROBOT_CREATE,\n                            PermissionName.ROBOT_UPDATE,\n                            PermissionName.ROBOT_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                built_in: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'is_confidential', 'secret', 'secret_hashed', 'secret_encrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'is_confidential'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    built_in: true,\n                    is_confidential: true,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n                    secret_hashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const robotCredentialsService = new RobotCredentialsService();\n\n        let robotStrategy : ProvisioningEntityStrategy<Robot> | undefined;\n        if (config.robotAdminSecretReset) {\n            robotStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['secret'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.robots = [\n            {\n                strategy: robotStrategy,\n                attributes: {\n                    name: 'system',\n                    secret: await robotCredentialsService.protect(config.robotAdminSecret),\n                    active: config.robotAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;AA0CA,IAAac,4BAAb,MAAaA;CACTC,gBAA4C;AACxC,SAAO;GACH;IACIC,YAAY;KACRC,MAAMf,iBAAiBgB;KACvBC,MAAMnB,kBAAkBoB;KACxBC,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB,EAAEC,mBAAmBvB,iBAAiBwB,WAAU;IACjEC,UAAU;KACN,EACIV,YAAY;MACRC,MAAMf,iBAAiByB;MACvBR,MAAMnB,kBAAkB2B;MACxBN,UAAU;MACVC,UAAU;MACd,EACJ;KACA,EACIN,YAAY;MACRC,MAAMf,iBAAiB0B;MACvBT,MAAMnB,kBAAkB4B;MACxBP,UAAU;MACVC,UAAU;MACd,EACJ;KACA;MACIN,YAAY;OACRC,MAAMf,iBAAiB2B;OACvBV,MAAMnB,kBAAkB6B;OACxBR,UAAU;OACVC,UAAU;OACd;MACAC,iBAAiB;OACbO,gBAAgB,CAAC,WAAW;OAC5BC,uBAAuB;OACvBC,2BAA2B;OAC3BC,0BAA0B;OAC9B;MACJ;KACH;IACL;GACA;IACIjB,YAAY;KACRC,MAAMf,iBAAiBgC;KACvBf,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,WAAW;KAC5BC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;KAC/B;IACJ;GACA;IACIhB,YAAY;KACRC,MAAMf,iBAAiBiC;KACvBhB,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,WAAW;KAC5BC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;KAC/B;IACJ;GACH;;CAGLI,mBAAmD;AAC/C,SAAOC,OAAOC,OAAOnC,eAAAA,CAChBoC,KAAKtB,UAAU;GACZuB,UAAU;IACNrB,MAAMN,+BAA+B4B;IACrCzB,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC;IACAI,UAAU;IACd;GACJ,EAAA;;CAGRqB,cAAyC;AACrC,SAAOL,OAAOC,OAAO/B,UAAAA,CAChBgC,KAAKtB,UAAU;GACZuB,UAAU;IACNrB,MAAMN,+BAA+B4B;IACrCzB,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC;IACAI,UAAU;IACd;GACJ,EAAA;;CAGRsB,aAAuC;AACnC,SAAO,CACH;GACIH,UAAU;IACNrB,MAAMN,+BAA+B4B;IACrCzB,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;IACd;GACAuB,WAAW,EAAEC,mBAAmB,CAAC,IAAI,EAAC;GAC1C,EACA;GACIL,UAAU;IACNrB,MAAMN,+BAA+B4B;IACrCzB,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;IACd;GACAuB,WAAW;IACPC,mBAAmB,CAAC,IAAI;IACxBC,0BAA0B;KACtB3C,eAAe4C;KACf5C,eAAe6C;KACf7C,eAAe8C;KAClB;IACDC,6BAA6BhD,iBAAiBiC;IAC9CgB,kCAAkC,GAC7BjD,iBAAiBgC,cAAc;KAC5B/B,eAAeiD;KACfjD,eAAekD;KACflD,eAAemD;KACfnD,eAAeoD;KACfpD,eAAeqD;KACfrD,eAAesD;KACftD,eAAeuD;KACfvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KAClB,EACL;IACJ;GACJ,CACH;;CAGL,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1CnC,UAAU;IACNrB,MAAMN,+BAA+B4B;IACrCzB,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;IACd;GACAuB,WAAW,EAAC;GAChB;EAEA,MAAMgC,yBAAyB,IAAIjE,wBAAAA;EAEnC,IAAIkE;AACJ,MAAIH,OAAOI,uBACPD,gBAAe;GACX1D,MAAMN,+BAA+B4B;GACrCzB,YAAY,CAAC,WAAW;GAC5B;AAGJ2D,cAAY/B,YAAY+B,YAAY/B,aAAa,EAAC;AAClD+B,cAAY/B,UAAUmC,QAAQ,CAC1B;GACIvC,UAAUqC;GACV7D,YAAY;IACRC,MAAM;IACN+D,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,kBAAiB;IACvEC,OAAO3E,mBAAmB,QAAA;IAC1B4E,QAAQV,OAAOW;IACnB;GACAzC,WAAW,EAAE0C,aAAa,CAACjF,gBAAgB,EAAC;GAChD,CACH;EAED,MAAMkF,2BAA2B,IAAI9E,0BAAAA;EAErC,IAAI+E;AACJ,MAAId,OAAOe,wBACPD,kBAAiB;GACbrE,MAAMN,+BAA+B4B;GACrCzB,YAAY;IAAC;IAAY;IAAmB;IAAU;IAAiB;IAAmB;GAC9F;MAEAwE,kBAAiB;GACbrE,MAAMN,+BAA+B4B;GACrCzB,YAAY,CAAC,YAAY,kBAAkB;GAC/C;AAGJ2D,cAAY/B,YAAY+B,YAAY/B,aAAa,EAAC;AAClD+B,cAAY/B,UAAU8C,UAAU,CAC5B;GACIlD,UAAUgD;GACVxE,YAAY;IACRK,UAAU;IACVsE,iBAAiB;IACjB1E,MAAM;IACN2E,QAAQ,MAAML,yBAAyBN,QAAQP,OAAOmB,oBAAoB,EAAEC,eAAe,OAAM,CAAA;IACjGA,eAAe;IACfV,QAAQV,OAAOqB;IACnB;GACAnD,WAAW,EAAE0C,aAAa,CAACjF,gBAAgB,EAAC;GAChD,CACH;EAED,MAAM2F,0BAA0B,IAAItF,yBAAAA;EAEpC,IAAIuF;AACJ,MAAIvB,OAAOwB,sBACPD,iBAAgB;GACZ9E,MAAMN,+BAA+B4B;GACrCzB,YAAY,CAAC,SAAS;GAC1B;AAGJ2D,cAAY/B,YAAY+B,YAAY/B,aAAa,EAAC;AAClD+B,cAAY/B,UAAUuD,SAAS,CAC3B;GACI3D,UAAUyD;GACVjF,YAAY;IACRC,MAAM;IACN2E,QAAQ,MAAMI,wBAAwBf,QAAQP,OAAO0B,iBAAgB;IACrEhB,QAAQV,OAAO2B;IACnB;GACAzD,WAAW,EAAE0C,aAAa,CAACjF,gBAAgB,EAAC;GAChD,CACH;AAED,SAAO,CAACsE,YAAY;;CAGxB,MAAM2B,KAAKC,WAAwD;EAC/D,MAAM7B,SAAS6B,UAAUC,QAAQ5F,mBAAAA;AAEjC,SAAO;GACH6F,UAAU,KAAK1F,eAAa;GAC5B2F,aAAa,KAAKtE,kBAAgB;GAClCuE,QAAQ,KAAKjE,aAAW;GACxBkE,OAAO,KAAKjE,YAAU;GACtBkE,QAAQ,MAAM,KAAKpC,YAAYC,OAAAA;GACnC"}
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","DecisionStrategy","SystemPolicyName","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","REALM_MATCH","attribute_name","attribute_name_strict","identity_master_match_all","attribute_null_match_all","REALM_BOUND","REALM_OR_GLOBAL","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","ROBOT_NAMES_SELF_MANAGE","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","ROBOT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","globalPermissionsPolicyName","globalPermissionsPolicyOverrides","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","is_confidential","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, DecisionStrategy, SystemPolicyName } from '@authup/access';\nimport type {\n    Client, \n    Permission, \n    Robot, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    RobotCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.REALM_MATCH,\n                            type: BuiltInPolicyType.REALM_MATCH,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                        extraAttributes: {\n                            attribute_name: ['realm_id'],\n                            attribute_name_strict: false,\n                            identity_master_match_all: false,\n                            attribute_null_match_all: true,\n                        },\n                    },\n                ],\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.REALM_BOUND,\n                    type: BuiltInPolicyType.REALM_MATCH,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    attribute_name: ['realm_id'],\n                    attribute_name_strict: false,\n                    attribute_null_match_all: false,\n                    identity_master_match_all: false,\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.REALM_OR_GLOBAL,\n                    type: BuiltInPolicyType.REALM_MATCH,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    attribute_name: ['realm_id'],\n                    attribute_name_strict: false,\n                    attribute_null_match_all: true,\n                    identity_master_match_all: false,\n                },\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realm_id',\n                        // Security-critical: a self-edit must not change the\n                        // client's confidentiality (toggling this clears the\n                        // secret) or downgrade the secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'is_confidential',\n                        'secret_hashed',\n                        'secret_encrypted',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'realm_id',\n                        'user_id',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'name_locked',\n                        'status',\n                        'status_message',\n                        'realm_id',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['built_in'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        built_in: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    built_in: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: { globalPermissions: ['*'] },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    globalPermissionsPolicyName: SystemPolicyName.REALM_OR_GLOBAL,\n                    globalPermissionsPolicyOverrides: {\n                        [SystemPolicyName.REALM_BOUND]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROBOT_CREATE,\n                            PermissionName.ROBOT_UPDATE,\n                            PermissionName.ROBOT_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                built_in: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'is_confidential', 'secret', 'secret_hashed', 'secret_encrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'is_confidential'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    built_in: true,\n                    is_confidential: true,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n                    secret_hashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const robotCredentialsService = new RobotCredentialsService();\n\n        let robotStrategy : ProvisioningEntityStrategy<Robot> | undefined;\n        if (config.robotAdminSecretReset) {\n            robotStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['secret'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.robots = [\n            {\n                strategy: robotStrategy,\n                attributes: {\n                    name: 'system',\n                    secret: await robotCredentialsService.protect(config.robotAdminSecret),\n                    active: config.robotAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;AA0CA,IAAac,4BAAb,MAAaA;CACTC,gBAA4C;AACxC,SAAO;GACH;IACIC,YAAY;KACRC,MAAMf,iBAAiBgB;KACvBC,MAAMnB,kBAAkBoB;KACxBC,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB,EAAEC,mBAAmBvB,iBAAiBwB,WAAU;IACjEC,UAAU;KACN,EACIV,YAAY;MACRC,MAAMf,iBAAiByB;MACvBR,MAAMnB,kBAAkB2B;MACxBN,UAAU;MACVC,UAAU;MACd,EACJ;KACA,EACIN,YAAY;MACRC,MAAMf,iBAAiB0B;MACvBT,MAAMnB,kBAAkB4B;MACxBP,UAAU;MACVC,UAAU;MACd,EACJ;KACA;MACIN,YAAY;OACRC,MAAMf,iBAAiB2B;OACvBV,MAAMnB,kBAAkB6B;OACxBR,UAAU;OACVC,UAAU;OACd;MACAC,iBAAiB;OACbO,gBAAgB,CAAC,WAAW;OAC5BC,uBAAuB;OACvBC,2BAA2B;OAC3BC,0BAA0B;OAC9B;MACJ;KACH;IACL;GACA;IACIjB,YAAY;KACRC,MAAMf,iBAAiBgC;KACvBf,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,WAAW;KAC5BC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;KAC/B;IACJ;GACA;IACIhB,YAAY;KACRC,MAAMf,iBAAiBiC;KACvBhB,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,WAAW;KAC5BC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;KAC/B;IACJ;GAKA;IACIhB,YAAY;KACRC,MAAMf,iBAAiBkC;KACvBjB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB,EACbgB,OAAO;KAEH;KACA;KAKA;KACA;KACA;KACH,EACL;IACJ;GACA;IACIvB,YAAY;KACRC,MAAMf,iBAAiBsC;KACvBrB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB,EACbgB,OAAO;KACH;KACA;KACA;KACH,EACL;IACJ;GACA;IACIvB,YAAY;KACRC,MAAMf,iBAAiBuC;KACvBtB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;KACd;IACAC,iBAAiB,EACbgB,OAAO;KACH;KACA;KACA;KACA;KACA;KACH,EACL;IACJ;GACH;;CAGLG,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3DxC,eAAeyC,qBAAqB,CAAC1C,iBAAiBgB,SAAShB,iBAAiBkC,yBAAyB;IACzGjC,eAAe0C,oBAAoB,CAAC3C,iBAAiBgB,SAAShB,iBAAiBsC,wBAAwB;IACvGrC,eAAe2C,mBAAmB,CAAC5C,iBAAiBgB,SAAShB,iBAAiBuC,uBAAuB;GAC1G;AAEA,SAAOM,OAAOC,OAAO7C,eAAAA,CAChB8C,KAAKhC,SAAAA;GACF,MAAMiC,SAAuC;IACzCC,UAAU;KACNhC,MAAMN,+BAA+BuC;KACrCpC,YAAY,CAAC,WAAW;KAC5B;IACAA,YAAY;KACRC;KACAI,UAAU;KACd;IACJ;GAEA,MAAMgC,WAAWV,qBAAqB1B;AACtC,OAAIoC,SACAH,QAAOI,YAAY,EAAED,UAAS;AAGlC,UAAOH;IACX;;CAGRK,cAAyC;AACrC,SAAOR,OAAOC,OAAOzC,UAAAA,CAChB0C,KAAKhC,UAAU;GACZkC,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC;IACAI,UAAU;IACd;GACJ,EAAA;;CAGRmC,aAAuC;AACnC,SAAO,CACH;GACIL,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;IACd;GACAiC,WAAW,EAAEG,mBAAmB,CAAC,IAAI,EAAC;GAC1C,EACA;GACIN,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;IACd;GACAiC,WAAW;IACPG,mBAAmB,CAAC,IAAI;IACxBC,0BAA0B;KACtBvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KAClB;IACDC,6BAA6B5D,iBAAiBiC;IAC9C4B,kCAAkC,GAC7B7D,iBAAiBgC,cAAc;KAC5B/B,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;KACf/E,eAAegF;KACfhF,eAAeiF;KAClB,EACL;IACJ;GACJ,CACH;;CAGL,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1CpC,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,WAAW;IAC5B;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;IACd;GACAiC,WAAW,EAAC;GAChB;EAEA,MAAMkC,yBAAyB,IAAI7E,wBAAAA;EAEnC,IAAI8E;AACJ,MAAIH,OAAOI,uBACPD,gBAAe;GACXtE,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,WAAW;GAC5B;AAGJuE,cAAYjC,YAAYiC,YAAYjC,aAAa,EAAC;AAClDiC,cAAYjC,UAAUqC,QAAQ,CAC1B;GACIxC,UAAUsC;GACVzE,YAAY;IACRC,MAAM;IACN2E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,kBAAiB;IACvEC,OAAOvF,mBAAmB,QAAA;IAC1BwF,QAAQV,OAAOW;IACnB;GACA3C,WAAW,EAAE4C,aAAa,CAAC7F,gBAAgB,EAAC;GAChD,CACH;EAED,MAAM8F,2BAA2B,IAAI1F,0BAAAA;EAErC,IAAI2F;AACJ,MAAId,OAAOe,wBACPD,kBAAiB;GACbjF,MAAMN,+BAA+BuC;GACrCpC,YAAY;IAAC;IAAY;IAAmB;IAAU;IAAiB;IAAmB;GAC9F;MAEAoF,kBAAiB;GACbjF,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,YAAY,kBAAkB;GAC/C;AAGJuE,cAAYjC,YAAYiC,YAAYjC,aAAa,EAAC;AAClDiC,cAAYjC,UAAUgD,UAAU,CAC5B;GACInD,UAAUiD;GACVpF,YAAY;IACRK,UAAU;IACVkF,iBAAiB;IACjBtF,MAAM;IACNuF,QAAQ,MAAML,yBAAyBN,QAAQP,OAAOmB,oBAAoB,EAAEC,eAAe,OAAM,CAAA;IACjGA,eAAe;IACfV,QAAQV,OAAOqB;IACnB;GACArD,WAAW,EAAE4C,aAAa,CAAC7F,gBAAgB,EAAC;GAChD,CACH;EAED,MAAMuG,0BAA0B,IAAIlG,yBAAAA;EAEpC,IAAImG;AACJ,MAAIvB,OAAOwB,sBACPD,iBAAgB;GACZ1F,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,SAAS;GAC1B;AAGJuE,cAAYjC,YAAYiC,YAAYjC,aAAa,EAAC;AAClDiC,cAAYjC,UAAUyD,SAAS,CAC3B;GACI5D,UAAU0D;GACV7F,YAAY;IACRC,MAAM;IACNuF,QAAQ,MAAMI,wBAAwBf,QAAQP,OAAO0B,iBAAgB;IACrEhB,QAAQV,OAAO2B;IACnB;GACA3D,WAAW,EAAE4C,aAAa,CAAC7F,gBAAgB,EAAC;GAChD,CACH;AAED,SAAO,CAACkF,YAAY;;CAGxB,MAAM2B,KAAKC,WAAwD;EAC/D,MAAM7B,SAAS6B,UAAUC,QAAQxG,mBAAAA;AAEjC,SAAO;GACHyC,UAAU,KAAKtC,eAAa;GAC5BsG,aAAa,KAAK3E,kBAAgB;GAClC4E,QAAQ,KAAK/D,aAAW;GACxBgE,OAAO,KAAK/D,YAAU;GACtBgE,QAAQ,MAAM,KAAKnC,YAAYC,OAAAA;GACnC"}

package/dist/components/database/unique-entries/module.mjs

@@ -1,5 +1,5 @@
-import { PermissionEntity } from "../../../adapters/database/domains/permission/entity.mjs";
 import { RoleEntity } from "../../../adapters/database/domains/role/entity.mjs";
+import { PermissionEntity } from "../../../adapters/database/domains/permission/entity.mjs";
 import "../../../adapters/database/domains/index.mjs";
 //#region src/components/database/unique-entries/module.ts
 var DatabaseUniqueEntriesComponent = class {

package/dist/core/entities/client/service.d.ts

@@ -15,7 +15,7 @@ export declare class ClientService extends AbstractEntityService implements ICli
     protected validator: ClientValidator;
     constructor(ctx: ClientServiceContext);
     getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<Client>>;
-    getOne(idOrName: string, actor: ActorContext, realmId?: string): Promise<Client>;
+    getOne(idOrName: string, actor: ActorContext, query?: Record<string, any>, realmId?: string): Promise<Client>;
     create(data: Record<string, any>, actor: ActorContext): Promise<Client>;
     update(idOrName: string, data: Record<string, any>, actor: ActorContext): Promise<Client>;
     save(idOrName: string | undefined, data: Record<string, any>, actor: ActorContext, options?: {

package/dist/core/entities/client/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EACH,eAAe,EAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAmD5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IAiDZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAiHI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EACH,eAAe,EAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAmD5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA2CZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAwII,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}

package/dist/core/entities/client/service.mjs

@@ -1,8 +1,8 @@
 import { ClientCredentialsService } from "../../authentication/credential/entities/client/module.mjs";
 import { AbstractEntityService } from "../service.mjs";
 import { ClientValidator, PermissionName, ValidatorGroup } from "@authup/core-kit";
-import { BuiltInPolicyType, PolicyData } from "@authup/access";
 import { isUUID } from "@authup/kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
 import { NotFoundError } from "@ebec/http";
 //#region src/core/entities/client/service.ts
 var ClientService = class extends AbstractEntityService {
@@ -51,29 +51,22 @@ var ClientService = class extends AbstractEntityService {
 			}
 		};
 	}
-	async getOne(idOrName, actor, realmId) {
-		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+	async getOne(idOrName, actor, query, realmId) {
+		const permissionNames = [
 			PermissionName.CLIENT_READ,
 			PermissionName.CLIENT_UPDATE,
 			PermissionName.CLIENT_DELETE
-		] });
-		let entity;
-		if (isUUID(idOrName)) entity = await this.repository.findOneByIdOrName(idOrName, realmId);
-		else if (realmId) {
-			const realm = await this.realmRepository.resolve(realmId);
-			if (realm) entity = await this.repository.findOneBy({
-				name: idOrName,
-				realm_id: realm.id
-			});
-			else entity = null;
-		} else entity = await this.repository.findOneByName(idOrName);
+		];
+		let isMe = !!actor.identity && actor.identity.type === "client" && (actor.identity.data.id === idOrName || actor.identity.data.name === idOrName);
+		if (!isMe) await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });
+		const entity = await this.repository.findOne(idOrName, query, realmId);
 		if (!entity) throw new NotFoundError();
-		if (entity.secret && !entity.secret_encrypted && !entity.secret_hashed) await actor.permissionEvaluator.evaluateOneOf({
-			name: [
-				PermissionName.CLIENT_READ,
-				PermissionName.CLIENT_UPDATE,
-				PermissionName.CLIENT_DELETE
-			],
+		if (isMe && actor.identity.data.id !== entity.id) {
+			isMe = false;
+			await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });
+		}
+		if (!isMe && entity.secret && !entity.secret_encrypted && !entity.secret_hashed) await actor.permissionEvaluator.evaluateOneOf({
+			name: permissionNames,
 			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
 		});
 		return entity;
@@ -98,8 +91,15 @@ var ClientService = class extends AbstractEntityService {
 			entity = await this.repository.findOneWithSecret(where);
 			if (!entity && options.updateOnly) throw new NotFoundError();
 		} else if (options.updateOnly) throw new NotFoundError();
+		let isSelfEdit = false;
 		if (entity) {
-			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });
+			try {
+				await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });
+			} catch (e) {
+				if (!actor.identity || actor.identity.type !== "client" || actor.identity.data.id !== entity.id) throw e;
+				isSelfEdit = true;
+				await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });
+			}
 			group = ValidatorGroup.UPDATE;
 		} else {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });
@@ -110,12 +110,16 @@ var ClientService = class extends AbstractEntityService {
 		await this.repository.checkUniqueness(validated, entity || void 0);
 		const credentialsService = new ClientCredentialsService();
 		if (entity) {
-			if (!validated.realm_id && !entity.realm_id) {
+			if (!isSelfEdit && !validated.realm_id && !entity.realm_id) {
 				const actorRealmId = this.getActorRealmId(actor);
 				if (actorRealmId) validated.realm_id = actorRealmId;
 			}
+			if (isSelfEdit) await actor.permissionEvaluator.evaluate({
+				name: PermissionName.CLIENT_SELF_MANAGE,
+				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+			});
 			entity = this.repository.merge(entity, validated);
-			await actor.permissionEvaluator.evaluate({
+			if (!isSelfEdit) await actor.permissionEvaluator.evaluate({
 				name: PermissionName.CLIENT_UPDATE,
 				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
 			});