@authup/server-core 1.0.0-beta.4 → 1.0.0-beta.40

package/dist/core/entities/user-permission/service.mjs

@@ -0,0 +1,101 @@
+import { AbstractEntityService } from "../service.mjs";
+import { PermissionName, UserPermissionValidator, ValidatorGroup } from "@authup/core-kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { ConflictError, NotFoundError } from "@ebec/http";
+//#region src/core/entities/user-permission/service.ts
+var UserPermissionService = class extends AbstractEntityService {
+	repository;
+	identityPermissionProvider;
+	validator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new UserPermissionValidator();
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.USER_PERMISSION_CREATE,
+			PermissionName.USER_PERMISSION_DELETE,
+			PermissionName.USER_PERMISSION_READ
+		] });
+		return this.repository.findMany(query);
+	}
+	async getOne(id, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.USER_PERMISSION_CREATE,
+			PermissionName.USER_PERMISSION_DELETE,
+			PermissionName.USER_PERMISSION_READ
+		] });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		return entity;
+	}
+	async create(data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_CREATE });
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			permission_id: validated.permission_id,
+			user_id: validated.user_id
+		})) throw new ConflictError("The user-permission assignment already exists.");
+		if (validated.permission) {
+			validated.permission_realm_id = validated.permission.realm_id;
+			await actor.permissionEvaluator.preEvaluate({
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
+			});
+		}
+		if (validated.user) validated.user_realm_id = validated.user.realm_id;
+		if (validated.permission && actor.identity && typeof validated.policy_id === "undefined") {
+			const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy({
+				type: actor.identity.type,
+				id: actor.identity.data.id
+			}, {
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
+			});
+			if (junctionPolicy) validated.policy_id = junctionPolicy.id;
+		}
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_PERMISSION_CREATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+		});
+		let entity = this.repository.create(validated);
+		entity = await this.repository.save(entity);
+		return entity;
+	}
+	async update(id, data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_UPDATE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		const updateData = {};
+		if (Object.prototype.hasOwnProperty.call(data, "policy_id")) updateData.policy_id = data.policy_id;
+		await this.repository.validateJoinColumns(updateData);
+		const merged = this.repository.merge(entity, updateData);
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_PERMISSION_UPDATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged })
+		});
+		return this.repository.save(merged);
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_PERMISSION_DELETE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+};
+//#endregion
+export { UserPermissionService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/user-permission/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ConflictError","NotFoundError","PermissionName","UserPermissionValidator","ValidatorGroup","AbstractEntityService","UserPermissionService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_PERMISSION_CREATE","USER_PERMISSION_DELETE","USER_PERMISSION_READ","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permission_id","user_id","permission","permission_realm_id","realm_id","realmId","clientId","client_id","user","user_realm_id","identity","policy_id","junctionPolicy","resolveJunctionPolicy","type","evaluate","input","ATTRIBUTES","save","update","USER_PERMISSION_UPDATE","updateData","Object","prototype","hasOwnProperty","call","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/user-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ConflictError, NotFoundError } from '@ebec/http';\nimport { PermissionName, UserPermissionValidator, ValidatorGroup } from '@authup/core-kit';\nimport type { UserPermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { ActorContext } from '../actor/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IUserPermissionRepository, IUserPermissionService } from './types.ts';\n\nexport type UserPermissionServiceContext = {\n    repository: IUserPermissionRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserPermissionService extends AbstractEntityService implements IUserPermissionService {\n    protected repository: IUserPermissionRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserPermissionValidator;\n\n    constructor(ctx: UserPermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserPermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserPermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_PERMISSION_CREATE,\n                PermissionName.USER_PERMISSION_DELETE,\n                PermissionName.USER_PERMISSION_READ,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_PERMISSION_CREATE,\n                PermissionName.USER_PERMISSION_DELETE,\n                PermissionName.USER_PERMISSION_READ,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            permission_id: validated.permission_id,\n            user_id: validated.user_id,\n        });\n        if (existing) {\n            throw new ConflictError('The user-permission assignment already exists.');\n        }\n\n        if (validated.permission) {\n            validated.permission_realm_id = validated.permission.realm_id;\n\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realm_id,\n                clientId: validated.permission.client_id,\n            });\n        }\n\n        if (validated.user) {\n            validated.user_realm_id = validated.user.realm_id;\n        }\n\n        if (\n            validated.permission &&\n            actor.identity &&\n            typeof validated.policy_id === 'undefined'\n        ) {\n            const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realm_id,\n                    clientId: validated.permission.client_id,\n                },\n            );\n            if (junctionPolicy) {\n                validated.policy_id = junctionPolicy.id;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const updateData: Record<string, any> = {};\n        if (Object.prototype.hasOwnProperty.call(data, 'policy_id')) {\n            updateData.policy_id = data.policy_id;\n        }\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_UPDATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;AAsBA,IAAaQ,wBAAb,cAA2CD,sBAAAA;CAC7BE;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;AAC3C,SAAK;AACL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,6BAA6BE,IAAIF;AACtC,OAAKC,YAAY,IAAIN,yBAAAA;;CAGzB,MAAMQ,QACFC,OACAC,OACuD;AACvD,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;AAEA,SAAO,KAAKZ,WAAWa,SAASR,MAAAA;;CAGpC,MAAMS,OACFC,IACAT,OACuB;AACvB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;AAGd,SAAOsB;;CAGX,MAAME,OACFC,MACAb,OACuB;AACvB,QAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAee,wBAAuB,CAAA;EAE1F,MAAMW,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO1B,eAAe2B,QAAO,CAAA;AAEhF,QAAM,KAAKxB,WAAWyB,oBAAoBJ,UAAAA;AAM1C,MAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,eAAeN,UAAUM;GACzBC,SAASP,UAAUO;GACvB,CAAA,CAEI,OAAM,IAAInC,cAAc,iDAAA;AAG5B,MAAI4B,UAAUQ,YAAY;AACtBR,aAAUS,sBAAsBT,UAAUQ,WAAWE;AAErD,SAAMzB,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMY,UAAUQ,WAAWpB;IAC3BuB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWK;IACnC,CAAA;;AAGJ,MAAIb,UAAUc,KACVd,WAAUe,gBAAgBf,UAAUc,KAAKJ;AAG7C,MACIV,UAAUQ,cACVvB,MAAM+B,YACN,OAAOhB,UAAUiB,cAAc,aACjC;GACE,MAAMC,iBAAiB,MAAM,KAAKtC,2BAA2BuC,sBACzD;IACIC,MAAMnC,MAAM+B,SAASI;IACrB1B,IAAIT,MAAM+B,SAASlB,KAAKJ;IAC5B,EACA;IACIN,MAAMY,UAAUQ,WAAWpB;IAC3BuB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWK;IACnC,CAAA;AAEJ,OAAIK,eACAlB,WAAUiB,YAAYC,eAAexB;;AAI7C,QAAMT,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMd,eAAee;GACrBiC,OAAO,IAAInD,WAAW,GAAGD,kBAAkBqD,aAAavB,WAAU,CAAA;GACtE,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,UAAAA;AACpCL,WAAS,MAAM,KAAKhB,WAAW6C,KAAK7B,OAAAA;AAEpC,SAAOA;;CAGX,MAAM8B,OACF/B,IACAI,MACAb,OACuB;AACvB,QAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAeoD,wBAAuB,CAAA;EAE1F,MAAM/B,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;EAGd,MAAMsD,aAAkC,EAAC;AACzC,MAAIC,OAAOC,UAAUC,eAAeC,KAAKjC,MAAM,YAAA,CAC3C6B,YAAWV,YAAYnB,KAAKmB;AAGhC,QAAM,KAAKtC,WAAWyB,oBAAoBuB,WAAAA;EAE1C,MAAMK,SAAS,KAAKrD,WAAWsD,MAAMtC,QAAQgC,WAAAA;AAE7C,QAAM1C,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMd,eAAeoD;GACrBJ,OAAO,IAAInD,WAAW,GAAGD,kBAAkBqD,aAAaS,QAAO,CAAA;GACnE,CAAA;AAEA,SAAO,KAAKrD,WAAW6C,KAAKQ,OAAAA;;CAGhC,MAAME,OACFxC,IACAT,OACuB;AACvB,QAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAegB,wBAAuB,CAAA;EAE1F,MAAMK,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;AAGd,QAAMY,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMd,eAAegB;GACrBgC,OAAO,IAAInD,WAAW,GAAGD,kBAAkBqD,aAAa5B,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAED,IAAIyC,aAAaxC;AACzB,QAAM,KAAKhB,WAAWyD,OAAOzC,OAAAA;AAC7BA,SAAOD,KAAKyC;AAEZ,SAAOxC"}

package/dist/core/entities/user-permission/types.d.ts

@@ -0,0 +1,13 @@
+import type { UserPermission } from '@authup/core-kit';
+import type { ActorContext } from '../actor/types.ts';
+import type { EntityRepositoryFindManyResult, IEntityRepository } from '../types.ts';
+export interface IUserPermissionRepository extends IEntityRepository<UserPermission> {
+}
+export interface IUserPermissionService {
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<UserPermission>>;
+    getOne(id: string, actor: ActorContext): Promise<UserPermission>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<UserPermission>;
+    update(id: string, data: Record<string, any>, actor: ActorContext): Promise<UserPermission>;
+    delete(id: string, actor: ActorContext): Promise<UserPermission>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/user-permission/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,WAAW,yBAA0B,SAAQ,iBAAiB,CAAC,cAAc,CAAC;CACnF;AAED,MAAM,WAAW,sBAAsB;IACnC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC,CAAC;IAClH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChF,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5F,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACpE"}

package/dist/core/entities/user-permission/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/entities/user-role/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/user-role/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/user-role/index.mjs

@@ -0,0 +1,2 @@
+import { UserRoleService } from "./service.mjs";
+export { UserRoleService };

package/dist/core/entities/user-role/service.d.ts

@@ -0,0 +1,22 @@
+import { UserRoleValidator } from '@authup/core-kit';
+import type { UserRole } from '@authup/core-kit';
+import type { ActorContext } from '../actor/types.ts';
+import { AbstractEntityService } from '../service.ts';
+import type { EntityRepositoryFindManyResult } from '../types.ts';
+import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
+import type { IUserRoleRepository, IUserRoleService } from './types.ts';
+export type UserRoleServiceContext = {
+    repository: IUserRoleRepository;
+    identityPermissionProvider: IIdentityPermissionProvider;
+};
+export declare class UserRoleService extends AbstractEntityService implements IUserRoleService {
+    protected repository: IUserRoleRepository;
+    protected identityPermissionProvider: IIdentityPermissionProvider;
+    protected validator: UserRoleValidator;
+    constructor(ctx: UserRoleServiceContext);
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<UserRole>>;
+    getOne(id: string, actor: ActorContext): Promise<UserRole>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<UserRole>;
+    delete(id: string, actor: ActorContext): Promise<UserRole>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/user-role/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/service.ts"],"names":[],"mappings":"AASA,OAAO,EAAkB,iBAAiB,EAAkB,MAAM,kBAAkB,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,MAAM,sBAAsB,GAAG;IACjC,UAAU,EAAE,mBAAmB,CAAC;IAChC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,eAAgB,SAAQ,qBAAsB,YAAW,gBAAgB;IAClF,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAE1C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,iBAAiB,CAAC;gBAE3B,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IAY9C,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAiBd,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAmDd,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;CAmBvB"}

package/dist/core/entities/user-role/service.mjs

@@ -0,0 +1,79 @@
+import { AbstractEntityService } from "../service.mjs";
+import { PermissionName, UserRoleValidator, ValidatorGroup } from "@authup/core-kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { ConflictError, ForbiddenError, NotFoundError } from "@ebec/http";
+//#region src/core/entities/user-role/service.ts
+var UserRoleService = class extends AbstractEntityService {
+	repository;
+	identityPermissionProvider;
+	validator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new UserRoleValidator();
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.USER_ROLE_READ,
+			PermissionName.USER_ROLE_CREATE,
+			PermissionName.USER_ROLE_UPDATE
+		] });
+		return this.repository.findMany(query);
+	}
+	async getOne(id, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.USER_ROLE_READ,
+			PermissionName.USER_ROLE_CREATE,
+			PermissionName.USER_ROLE_UPDATE
+		] });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		return entity;
+	}
+	async create(data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_CREATE });
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			role_id: validated.role_id,
+			user_id: validated.user_id
+		})) throw new ConflictError("The user-role assignment already exists.");
+		if (validated.role) validated.role_realm_id = validated.role.realm_id;
+		if (validated.user) validated.user_realm_id = validated.user.realm_id;
+		if (validated.role && actor.identity) {
+			if (!await this.identityPermissionProvider.isSuperset({
+				type: actor.identity.type,
+				id: actor.identity.data.id
+			}, {
+				type: "role",
+				id: validated.role_id,
+				clientId: validated.role.client_id
+			})) throw new ForbiddenError("You don't own the required permissions.");
+		}
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_ROLE_CREATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+		});
+		let entity = this.repository.create(validated);
+		entity = await this.repository.save(entity);
+		return entity;
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_ROLE_DELETE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+};
+//#endregion
+export { UserRoleService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/user-role/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ConflictError","ForbiddenError","NotFoundError","PermissionName","UserRoleValidator","ValidatorGroup","AbstractEntityService","UserRoleService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_ROLE_READ","USER_ROLE_CREATE","USER_ROLE_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","role_id","user_id","role","role_realm_id","realm_id","user","user_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","evaluate","input","ATTRIBUTES","save","delete","USER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/user-role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ConflictError, ForbiddenError, NotFoundError } from '@ebec/http';\nimport { PermissionName, UserRoleValidator, ValidatorGroup } from '@authup/core-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IUserRoleRepository, IUserRoleService } from './types.ts';\n\nexport type UserRoleServiceContext = {\n    repository: IUserRoleRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserRoleService extends AbstractEntityService implements IUserRoleService {\n    protected repository: IUserRoleRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserRoleValidator;\n\n    constructor(ctx: UserRoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserRoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserRole>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            role_id: validated.role_id,\n            user_id: validated.user_id,\n        });\n        if (existing) {\n            throw new ConflictError('The user-role assignment already exists.');\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (validated.user) {\n            validated.user_realm_id = validated.user.realm_id;\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new ForbiddenError('You don\\'t own the required permissions.');\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;AAsBA,IAAaS,kBAAb,cAAqCD,sBAAAA;CACvBE;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;AACrC,SAAK;AACL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,6BAA6BE,IAAIF;AACtC,OAAKC,YAAY,IAAIN,mBAAAA;;CAGzB,MAAMQ,QACFC,OACAC,OACiD;AACjD,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;AAEA,SAAO,KAAKZ,WAAWa,SAASR,MAAAA;;CAGpC,MAAMS,OACFC,IACAT,OACiB;AACjB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;AAGd,SAAOsB;;CAGX,MAAME,OACFC,MACAb,OACiB;AACjB,QAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAegB,kBAAiB,CAAA;EAEpF,MAAMU,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO1B,eAAe2B,QAAO,CAAA;AAEhF,QAAM,KAAKxB,WAAWyB,oBAAoBJ,UAAAA;AAM1C,MAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,SAASN,UAAUM;GACnBC,SAASP,UAAUO;GACvB,CAAA,CAEI,OAAM,IAAIpC,cAAc,2CAAA;AAG5B,MAAI6B,UAAUQ,KACVR,WAAUS,gBAAgBT,UAAUQ,KAAKE;AAG7C,MAAIV,UAAUW,KACVX,WAAUY,gBAAgBZ,UAAUW,KAAKD;AAG7C,MAAIV,UAAUQ,QAAQvB,MAAM4B;OAYpB,CAACC,MAXwB,KAAKlC,2BAA2BmC,WACzD;IACIC,MAAM/B,MAAM4B,SAASG;IACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;IAC5B,EACA;IACIsB,MAAM;IACNtB,IAAIM,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKU;IAC7B,CAAA,CAGA,OAAM,IAAI9C,eAAe,0CAAA;;AAIjC,QAAMa,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMd,eAAegB;GACrB8B,OAAO,IAAIlD,WAAW,GAAGD,kBAAkBoD,aAAarB,WAAU,CAAA;GACtE,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,UAAAA;AACpCL,WAAS,MAAM,KAAKhB,WAAW2C,KAAK3B,OAAAA;AAEpC,SAAOA;;CAGX,MAAM4B,OACF7B,IACAT,OACiB;AACjB,QAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAekD,kBAAiB,CAAA;EAEpF,MAAM7B,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;AAGd,QAAMY,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMd,eAAekD;GACrBJ,OAAO,IAAIlD,WAAW,GAAGD,kBAAkBoD,aAAa1B,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAED,IAAI+B,aAAa9B;AACzB,QAAM,KAAKhB,WAAW+C,OAAO/B,OAAAA;AAC7BA,SAAOD,KAAK+B;AAEZ,SAAO9B"}

package/dist/core/entities/user-role/types.d.ts

@@ -0,0 +1,12 @@
+import type { UserRole } from '@authup/core-kit';
+import type { ActorContext } from '../actor/types.ts';
+import type { EntityRepositoryFindManyResult, IEntityRepository } from '../types.ts';
+export interface IUserRoleRepository extends IEntityRepository<UserRole> {
+}
+export interface IUserRoleService {
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<UserRole>>;
+    getOne(id: string, actor: ActorContext): Promise<UserRole>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<UserRole>;
+    delete(id: string, actor: ActorContext): Promise<UserRole>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/user-role/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB,CAAC,QAAQ,CAAC;CACvE;AAED,MAAM,WAAW,gBAAgB;IAC7B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5G,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1E,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC9D"}

package/dist/core/entities/user-role/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/entities/client/index.d.ts

@@ -0,0 +1,2 @@
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/entities/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}

package/dist/core/identity/entities/client/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/entities/client/types.d.ts

@@ -0,0 +1,8 @@
+import type { Client } from '@authup/core-kit';
+export interface IClientIdentityRepository {
+    findOneById(id: string): Promise<Client | null>;
+    findOneByName(name: string, realm?: string): Promise<Client | null>;
+    findOneByIdOrName(idOrName: string, realm?: string): Promise<Client | null>;
+    findOneBy(where: Record<string, any>): Promise<Client | null>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/entities/client/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,WAAW,yBAAyB;IACtC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5E,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACjE"}

package/dist/core/identity/entities/client/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/entities/index.d.ts

@@ -0,0 +1,4 @@
+export * from './client/index.ts';
+export * from './user/index.ts';
+export * from './robot/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/entities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC"}

package/dist/core/identity/entities/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/entities/robot/index.d.ts

@@ -0,0 +1,2 @@
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/entities/robot/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/entities/robot/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}

package/dist/core/identity/entities/robot/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/entities/robot/types.d.ts

@@ -0,0 +1,8 @@
+import type { Robot } from '@authup/core-kit';
+export interface IRobotIdentityRepository {
+    findOneById(id: string): Promise<Robot | null>;
+    findOneByName(name: string, realm?: string): Promise<Robot | null>;
+    findOneByIdOrName(idOrName: string, realm?: string): Promise<Robot | null>;
+    findOneBy(where: Record<string, any>): Promise<Robot | null>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/entities/robot/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/entities/robot/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,WAAW,wBAAwB;IACrC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC/C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACnE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC3E,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;CAChE"}

package/dist/core/identity/entities/robot/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/entities/user/index.d.ts

@@ -0,0 +1,2 @@
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/entities/user/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/entities/user/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}

package/dist/core/identity/entities/user/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/entities/user/types.d.ts

@@ -0,0 +1,12 @@
+import type { User } from '@authup/core-kit';
+import type { IdentityProviderMapperElement } from '../../provider/index.ts';
+export interface IUserIdentityRepository {
+    findOneById(id: string): Promise<User | null>;
+    findOneByName(name: string, realm?: string): Promise<User | null>;
+    findOneByIdOrName(idOrName: string, realm?: string): Promise<User | null>;
+    findOneBy(where: Record<string, any>): Promise<User | null>;
+    savePermissions(user: User, items: IdentityProviderMapperElement[]): Promise<void>;
+    saveRoles(user: User, items: IdentityProviderMapperElement[]): Promise<void>;
+    saveOneWithEA(user: Partial<User>, extraAttributes: Record<string, any>): Promise<User>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/entities/user/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/entities/user/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAE7E,MAAM,WAAW,uBAAuB;IACpC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAClE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC1E,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAE5D,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5F"}

package/dist/core/identity/entities/user/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/index.d.ts

@@ -0,0 +1,8 @@
+export * from './entities/index.ts';
+export * from './password-recovery/index.ts';
+export * from './permission/index.ts';
+export * from './provider/index.ts';
+export * from './registration/index.ts';
+export * from './resolver/index.ts';
+export * from './role/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/identity/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC"}

package/dist/core/identity/index.mjs

@@ -0,0 +1,28 @@
+import { PasswordRecoveryService } from "./password-recovery/service.mjs";
+import "./password-recovery/index.mjs";
+import { IdentityPermissionProvider } from "./permission/module.mjs";
+import "./permission/index.mjs";
+import { IdentityProviderMapperOperation } from "./provider/mapper/constants.mjs";
+import { IdentityProviderAccountBaseMapper } from "./provider/mapper/base.mjs";
+import { IdentityProviderAttributeMapper } from "./provider/mapper/attributes/module.mjs";
+import { IdentityProviderRoleMapper } from "./provider/mapper/role/module.mjs";
+import { IdentityProviderPermissionMapper } from "./provider/mapper/permission/module.mjs";
+import { IdentityProviderAccountManager } from "./provider/account/module.mjs";
+import { IdentityProviderLdapAuthenticator } from "./provider/authentication/protocols/ldap/module.mjs";
+import { IdentityProviderLdapCollectionAuthenticator } from "./provider/authentication/protocols/ldap/collection.mjs";
+import { IdentityProviderOAuth2Authenticator } from "./provider/authentication/protocols/oauth2/module.mjs";
+import { IdentityProviderOpenIDAuthenticator } from "./provider/authentication/protocols/open-id/module.mjs";
+import { IdentityProviderFacebookAuthenticator } from "./provider/authentication/presets/facebook.mjs";
+import { IdentityProviderGithubAuthenticator } from "./provider/authentication/presets/github.mjs";
+import { IdentityProviderGoogleAuthenticator } from "./provider/authentication/presets/google.mjs";
+import { IdentityProviderInstagramAuthenticator } from "./provider/authentication/presets/instagram.mjs";
+import { IdentityProviderPaypalAuthenticator } from "./provider/authentication/presets/paypal.mjs";
+import { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN } from "./provider/authentication/constants.mjs";
+import { createIdentityProviderOAuth2Authenticator } from "./provider/authentication/factory.mjs";
+import "./provider/index.mjs";
+import { RegistrationService } from "./registration/service.mjs";
+import "./registration/index.mjs";
+import { IdentityResolver } from "./resolver/module.mjs";
+import "./resolver/index.mjs";
+import { IdentityRoleProvider } from "./role/module.mjs";
+export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityResolver, IdentityRoleProvider, PasswordRecoveryService, RegistrationService, createIdentityProviderOAuth2Authenticator };

package/dist/core/identity/password-recovery/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/password-recovery/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/identity/password-recovery/index.mjs

@@ -0,0 +1,2 @@
+import { PasswordRecoveryService } from "./service.mjs";
+export { PasswordRecoveryService };

package/dist/core/identity/password-recovery/service.d.ts

@@ -0,0 +1,15 @@
+import type { IPasswordRecoveryService, PasswordForgotResult, PasswordRecoveryServiceContext, PasswordRecoveryServiceOptions, PasswordResetResult } from './types.ts';
+import type { IMailClient } from '../../mail/types.ts';
+import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+export declare class PasswordRecoveryService implements IPasswordRecoveryService {
+    protected options: PasswordRecoveryServiceOptions;
+    protected repository: IUserRepository;
+    protected realmRepository: IRealmRepository;
+    protected mailClient: IMailClient;
+    constructor(ctx: PasswordRecoveryServiceContext);
+    forgotPassword(data: Record<string, any>): Promise<PasswordForgotResult>;
+    resetPassword(data: Record<string, any>): Promise<PasswordResetResult>;
+    private runForgotPasswordValidator;
+    private runResetPasswordValidator;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/identity/password-recovery/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/service.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,OAAO,EAAE,8BAA8B,CAAC;IAElD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IAOzC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAsDxE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;YA0C9D,0BAA0B;YA8C1B,yBAAyB;CA2E1C"}

package/dist/core/identity/password-recovery/service.mjs

@@ -0,0 +1,124 @@
+import { UserCredentialsService } from "../../authentication/credential/entities/user/module.mjs";
+import { BadRequestError, NotFoundError } from "@ebec/http";
+import { Container } from "validup";
+import { createValidationChain, createValidator } from "@validup/adapter-validator";
+import { randomBytes } from "node:crypto";
+//#region src/core/identity/password-recovery/service.ts
+var PasswordRecoveryService = class {
+	options;
+	repository;
+	realmRepository;
+	mailClient;
+	constructor(ctx) {
+		this.options = ctx.options;
+		this.repository = ctx.repository;
+		this.realmRepository = ctx.realmRepository;
+		this.mailClient = ctx.mailClient;
+	}
+	async forgotPassword(data) {
+		if (!this.options.passwordRecoveryEnabled) throw new BadRequestError("Password recovery is not enabled.");
+		if (!this.options.emailVerificationEnabled) throw new BadRequestError("Email verification is not enabled, but required to reset a password.");
+		const validated = await this.runForgotPasswordValidator(data);
+		const realm = await this.realmRepository.resolve(validated.realm_id, true);
+		const where = {
+			...validated.name ? { name: validated.name } : {},
+			...validated.email ? { email: validated.email } : {},
+			realm_id: realm.id
+		};
+		const entity = await this.repository.findOneByWithEmail(where);
+		if (!entity) throw new NotFoundError();
+		const merged = this.repository.merge(entity, {
+			reset_expires: new Date(Date.now() + 1e3 * 60 * 30).toISOString(),
+			reset_hash: randomBytes(32).toString("hex")
+		});
+		await this.repository.save(merged);
+		try {
+			await this.mailClient.send({
+				to: entity.email,
+				subject: "Forgot Password - Reset code",
+				html: `
+                <p>Please use the code below to reset your account password.</p>
+                <p>${merged.reset_hash}</p>
+                `
+			});
+		} catch {
+			this.repository.merge(merged, {
+				reset_hash: null,
+				reset_expires: null
+			});
+			await this.repository.save(merged);
+			throw new BadRequestError("Password recovery failed. Could not send reset email.");
+		}
+		return { reset_expires: merged.reset_expires };
+	}
+	async resetPassword(data) {
+		if (!this.options.passwordRecoveryEnabled) throw new BadRequestError("Password recovery is not enabled.");
+		const validated = await this.runResetPasswordValidator(data);
+		await this.repository.validateJoinColumns(validated);
+		const realm = await this.realmRepository.resolve(validated.realm_id, true);
+		const where = {
+			...validated.name ? { name: validated.name } : {},
+			...validated.email ? { email: validated.email } : {},
+			reset_hash: validated.token,
+			realm_id: realm.id
+		};
+		const entity = await this.repository.findOneBy(where);
+		if (!entity) throw new NotFoundError();
+		if (!entity.reset_expires || new Date(entity.reset_expires) < /* @__PURE__ */ new Date()) throw new BadRequestError("Reset token has expired.");
+		const hashedPassword = await new UserCredentialsService().protect(validated.password);
+		const merged = this.repository.merge(entity, {
+			reset_at: (/* @__PURE__ */ new Date()).toISOString(),
+			reset_hash: null,
+			reset_expires: null,
+			password: hashedPassword
+		});
+		await this.repository.save(merged);
+		return { reset_at: merged.reset_at };
+	}
+	async runForgotPasswordValidator(data) {
+		const validator = new Container({});
+		const oneOfContainer = new Container({ oneOf: true });
+		oneOfContainer.mount("email", createValidator(() => {
+			return createValidationChain().exists().notEmpty().trim().toLowerCase().isEmail().matches(/^[^A-Z]+$/).withMessage("Email must be lowercase.");
+		}));
+		oneOfContainer.mount("name", createValidator(() => {
+			return createValidationChain().exists().notEmpty().isString().trim().toLowerCase();
+		}));
+		validator.mount(oneOfContainer);
+		validator.mount("realm_id", { optional: true }, createValidator(() => {
+			return createValidationChain().exists().isUUID().optional({ values: "null" });
+		}));
+		return validator.run(data);
+	}
+	async runResetPasswordValidator(data) {
+		const validator = new Container({});
+		const oneOfContainer = new Container({ oneOf: true });
+		oneOfContainer.mount("email", createValidator(() => {
+			return createValidationChain().exists().notEmpty().trim().toLowerCase().isEmail().matches(/^[^A-Z]+$/).withMessage("Email must be lowercase.");
+		}));
+		oneOfContainer.mount("name", createValidator(() => {
+			return createValidationChain().exists().notEmpty().isString().trim().toLowerCase();
+		}));
+		validator.mount(oneOfContainer);
+		validator.mount("realm_id", { optional: true }, createValidator(() => {
+			return createValidationChain().exists().isUUID().optional({ values: "null" });
+		}));
+		validator.mount("token", createValidator(() => {
+			return createValidationChain().exists().notEmpty().isLength({
+				min: 3,
+				max: 256
+			});
+		}));
+		validator.mount("password", createValidator(() => {
+			return createValidationChain().exists().notEmpty().isLength({
+				min: 5,
+				max: 512
+			});
+		}));
+		return validator.run(data);
+	}
+};
+//#endregion
+export { PasswordRecoveryService };
+
+//# sourceMappingURL=service.mjs.map